bazarr: 1.5.6 -> 1.6.0 (#538399)

Linux was done in 8b266eba3a.

Release note: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -36,48 +36,62 @@ let
       toString value
   ) cfg.settings;
 
-  commonServiceConfig = {
-    RuntimeDirectory = "lasuite-meet";
-    StateDirectory = "lasuite-meet";
-    WorkingDirectory = "/var/lib/lasuite-meet";
+  commonSystemdConfig = {
+    after = [
+      "network.target"
+    ]
+    ++ (optional cfg.postgresql.createLocally "postgresql.service")
+    ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
 
-    User = "lasuite-meet";
-    DynamicUser = true;
-    SupplementaryGroups = mkIf cfg.redis.createLocally [
-      config.services.redis.servers.lasuite-meet.group
-    ];
-    # hardening
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = [ "" ];
-    DevicePolicy = "closed";
-    LockPersonality = true;
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    MemoryDenyWriteExecute = true;
-    EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
-    UMask = "0077";
+    wants =
+      (optional cfg.postgresql.createLocally "postgresql.service")
+      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+
+    environment = pythonEnvironment;
+
+    serviceConfig = {
+      RuntimeDirectory = "lasuite-meet";
+      StateDirectory = "lasuite-meet";
+      WorkingDirectory = "/var/lib/lasuite-meet";
+
+      User = "lasuite-meet";
+      DynamicUser = true;
+      SupplementaryGroups = mkIf cfg.redis.createLocally [
+        config.services.redis.servers.lasuite-meet.group
+      ];
+      # hardening
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      MemoryDenyWriteExecute = true;
+      EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+      UMask = "0077";
+    };
   };
 in
 {
@@ -342,74 +356,54 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.lasuite-meet = {
-      description = "Meet from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet = lib.mkMerge [
+      {
+        description = "Meet from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      preStart = ''
-        if [ ! -f .version ]; then
-          touch .version
-        fi
-
-        ${optionalString (cfg.secretKeyPath == null) ''
-          if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
-            (
-              umask 0377
-              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
-            )
+        preStart = ''
+          if [ ! -f .version ]; then
+            touch .version
           fi
-        ''}
-        if [ "${cfg.package.version}" != "$(cat .version)" ]; then
-          ${getExe cfg.package} migrate
-          echo -n "${cfg.package.version}" > .version
-        fi
-      '';
 
-      environment = pythonEnvironment;
+          ${optionalString (cfg.secretKeyPath == null) ''
+            if [[ ! -f /var/lib/lasuite-meet/django_secret_key ]]; then
+              (
+                umask 0377
+                tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-meet/django_secret_key
+              )
+            fi
+          ''}
+          if [ "${cfg.package.version}" != "$(cat .version)" ]; then
+            ${getExe cfg.package} migrate
+            echo -n "${cfg.package.version}" > .version
+          fi
+        '';
 
-      serviceConfig = {
-        BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
+        serviceConfig = {
+          BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
-        ExecStart = utils.escapeSystemdExecArgs (
-          [
-            (lib.getExe' cfg.package "gunicorn")
-            "--bind=${cfg.bind}"
-          ]
-          ++ cfg.gunicorn.extraArgs
-          ++ [ "meet.wsgi:application" ]
-        );
+          ExecStart = utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "gunicorn")
+              "--bind=${cfg.bind}"
+            ]
+            ++ cfg.gunicorn.extraArgs
+            ++ [ "meet.wsgi:application" ]
+          );
+        };
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
 
-    systemd.services.lasuite-meet-celery = {
-      description = "Meet Celery broker from SuiteNumérique";
-      after = [
-        "network.target"
-      ]
-      ++ (optional cfg.postgresql.createLocally "postgresql.service")
-      ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+    systemd.services.lasuite-meet-celery = lib.mkMerge [
+      {
+        description = "Meet Celery broker from SuiteNumérique";
 
-      wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
-        ++ (optional cfg.redis.createLocally "redis-lasuite-meet.service");
+        wantedBy = [ "multi-user.target" ];
 
-      wantedBy = [ "multi-user.target" ];
-
-      environment = pythonEnvironment;
-
-      serviceConfig = {
-        ExecStart = utils.escapeSystemdExecArgs (
+        serviceConfig.ExecStart = utils.escapeSystemdExecArgs (
           [ (lib.getExe' cfg.package "celery") ]
           ++ cfg.celery.extraArgs
           ++ [
@@ -418,8 +412,26 @@ in
           ]
         );
       }
-      // commonServiceConfig;
-    };
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-clean-pending-files = lib.mkMerge [
+      {
+        description = "Scheduled job to clean up pending uploads from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} clean_pending_files";
+      }
+      commonSystemdConfig
+    ];
+
+    systemd.services.lasuite-meet-purge-deleted-files = lib.mkMerge [
+      {
+        description = "Scheduled job to purge deleted files from LaSuite Meet";
+        startAt = "daily";
+        serviceConfig.ExecStart = "${getExe cfg.package} purge_deleted_files";
+      }
+      commonSystemdConfig
+    ];
 
     services.postgresql = mkIf cfg.postgresql.createLocally {
       enable = true;

pkgs/applications/editors/vim/plugins/non-generated/meson/default.nix

@@ -8,11 +8,9 @@ vimUtils.buildVimPlugin {
   preInstall = "cd data/syntax-highlighting/vim";
 
   meta = {
+    description = "Vim plugin for meson providing syntax highlighting";
     inherit (meson.meta)
       homepage
-      description
-      mainProgram
-      longDescription
       license
       platforms
       ;

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-19";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
-    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
+    rev = "340f9e9014c292fc47a8844a871a71dafe072b6d";
+    hash = "sha256-geBK8RIlaRcWn4CDzVl3pjK0WOFQcMZl7zFMXE2oZNo=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/prboom.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prboom";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-prboom";
-    rev = "b760de6a1eb1bfcd7833c5b677ff9170d104302f";
-    hash = "sha256-JZrQbhntCGV4WIktUbtVXCSGAEmh9gTPn+tLiMyt6ZY=";
+    rev = "141978db577b52cb943641629401776e49ccbbe6";
+    hash = "sha256-USRBq+h2HAoDIdYVd47wGLEnUzJAEOvikuvSNTHpboI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/stella2014.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella2014";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-07-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "stella2014-libretro";
-    rev = "eed47e154d1bbda3305e9ef2d486b6710c8973f4";
-    hash = "sha256-QpPjVnFCkn6xlB7LxpE6bsNfYe3HSsEKUjqmEf2yTvA=";
+    rev = "8ddf2146ed2d2053cff9df64192f920e57709629";
+    hash = "sha256-VDywbP7PhcQPHhu/KMvV1LlI/iOGjMzRooqvoT+Tnxc=";
   };
 
   makefile = "Makefile";

pkgs/by-name/ba/bazarr/package.nix

@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "1.5.6";
+  version = "1.6.0";
 
   src = fetchzip {
     url = "https://github.com/morpheus65535/bazarr/releases/download/v${version}/bazarr.zip";
-    hash = "sha256-S3idNH9Wm9f6aNj69dERmeks1rLvUeQJYFebXa5cWQo=";
+    hash = "sha256-LRcc2wg5u260yl3A7rRwBfldl6WOyvF2T9NKGTKabfw=";
     stripRoot = false;
   };
 

pkgs/by-name/dp/dprint/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.54.0";
+  version = "0.55.1";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dprint";
     repo = "dprint";
     tag = finalAttrs.version;
-    hash = "sha256-dNs2LQeEndeXS8xR9SXVFWT9PS+haB9SDZ+3PUPkFjg=";
+    hash = "sha256-OXXLpKgP2cUuPl7ikgZVPFgJiLY0Zy8MmBkz8Kp2+XM=";
   };
 
-  cargoHash = "sha256-fmbO14eTObK1cZu9gDls25KRmzAJPGiqQ8uURGD2vV0=";
+  cargoHash = "sha256-IDxJPicTq0/7LI/07QfJrteaKAHDoeKdzpbEv871xxE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/go/google-chrome/package.nix

@@ -289,11 +289,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.201";
+    version = "150.0.7871.47";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ph3mj7mqtvbfhr67ckmjvjj5a4_149.0.7827.201/GoogleChrome-149.0.7827.201.dmg";
-      hash = "sha256-AI5oBE0uB2/YacF9LB4d6rXlAqEuZtlPYNQwLbs1K7E=";
+      url = "http://dl.google.com/release2/chrome/ad2pojsfcj6hr5telal5kk4t6gua_150.0.7871.47/GoogleChrome-150.0.7871.47.dmg";
+      hash = "sha256-1VTMVSBLfSRp9CxPaRkmdgAC0H5KNuZNWywTGLSphUI=";
     };
 
     dontPatch = true;

pkgs/by-name/in/interval-tree/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "interval-tree";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "5cript";
     repo = "interval-tree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSZ56EzzNy6gHgs8OptT/iBlf56RJz+09BE4WGGJpog=";
+    hash = "sha256-t1/oTr+sYkpTiDzaM4SxUcWzO3r24EkUJO04TYNLcQQ=";
   };
 
   # interval-tree is a header only library

pkgs/by-name/la/lasuite-meet/frontend.nix

@@ -3,17 +3,37 @@
   version,
   meta,
   fetchNpmDeps,
+  fetchpatch,
   buildNpmPackage,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "lasuite-meet-frontend";
   inherit src version;
 
+  patches = [
+    # backport build fix
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://github.com/suitenumerique/meet/commit/df1495c97bc913866169ee8875a9a3169fcfc87e.diff";
+      stripLen = 2;
+      includes = [
+        "package.json"
+        "package-lock.json"
+      ];
+      hash = "sha256-1A26T6LtFlOiJNVGD/fZs562feoQXY37A2ecUfvDGpk=";
+    })
+  ];
+
   sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
   npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) version src sourceRoot;
-    hash = "sha256-YnHjuwDp293KVNTYTd4KcZqMamZNeccOdpSGgJ9a3G8=";
+    inherit (finalAttrs)
+      version
+      src
+      patches
+      sourceRoot
+      ;
+    hash = "sha256-uiD5pcpmka43uraMFo7lRuQFx/4aq1BEhQvyCAzo8fg=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/mail.nix

@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-yq88kbrKn9HMwvxcWNXm7zonAqTs8T2i7iQAsD0TtnU=";
+    hash = "sha256-EPVkSzhecDZpvz+uOW0GZnmWl9KfE3UpkTCnhVnJ7dg=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/package.nix

@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-pUCSdnTBj/qwc0cya3P96r89r2K1GNSGg4DeIhxUKwI=";
+    hash = "sha256-w2Lw5K62Iaqzqa/ckxK36o5ZHFLXUpHnGGGl5PYGjaI=";
   };
 
   meta = {
@@ -86,6 +86,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       mozilla-django-oidc
       nested-multipart-parser
       phonenumbers
+      posthog
       psycopg
       pydantic
       pyjwt

pkgs/by-name/sn/snipaste/package.nix

@@ -2,26 +2,23 @@
   appimageTools,
   lib,
   fetchurl,
+  stdenv,
+  stdenvNoCC,
+  undmg,
+  makeWrapper,
 }:
-let
-  pname = "snipaste";
-  version = "2.10.8";
-  src = fetchurl {
-    url = "https://download.snipaste.com/archives/Snipaste-${version}-x86_64.AppImage";
-    hash = "sha256-Ieitxc1HPjqBpf7/rREKca+U0srE+q/s8mz+9Vhczk0=";
-  };
-  contents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-  passthru.updateScript = ./update.sh;
 
-  extraInstallCommands = ''
-    install -d $out/share/{applications,icons}
-    cp ${contents}/usr/share/applications/*.desktop -t $out/share/applications/
-    cp -r ${contents}/usr/share/icons/* -t $out/share/icons/
-    substituteInPlace $out/share/applications/*.desktop --replace-warn 'Exec=Snipaste' 'Exec=${pname}'
-  '';
+let
+  sources = import ./sources.nix { inherit fetchurl; };
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  pname = "snipaste";
+  inherit (source) version src;
+
+  passthru = {
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Screenshot tools";
@@ -32,7 +29,58 @@ appimageTools.wrapType2 {
       ltrump
     ];
     mainProgram = "snipaste";
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
   };
-}
+in
+if stdenv.hostPlatform.isDarwin then
+  stdenvNoCC.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    nativeBuildInputs = [
+      undmg
+      makeWrapper
+    ];
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications $out/bin
+      cp -R Snipaste.app $out/Applications
+      makeWrapper $out/Applications/Snipaste.app/Contents/MacOS/Snipaste $out/bin/snipaste
+
+      runHook postInstall
+    '';
+  }
+else
+  let
+    contents = appimageTools.extract { inherit pname version src; };
+  in
+  appimageTools.wrapType2 {
+    inherit
+      pname
+      version
+      src
+      passthru
+      meta
+      ;
+
+    extraInstallCommands = ''
+      install -d $out/share/{applications,icons}
+      install -m 444 ${contents}/Snipaste.desktop $out/share/applications/${pname}.desktop
+      cp -r ${contents}/usr/share/icons/* -t $out/share/icons/
+      substituteInPlace $out/share/applications/${pname}.desktop --replace-warn 'Exec=Snipaste' 'Exec=${pname}'
+    '';
+  }

pkgs/by-name/sn/snipaste/sources.nix

@@ -0,0 +1,23 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2026-06-20
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "2.11.3";
+    src = fetchurl {
+      url = "https://download.snipaste.com/archives/Snipaste-2.11.3.dmg";
+      hash = "sha256-oih4OIieexc0pl2VK65e9/R5vcFj0MMb6RhZvKEg/T4=";
+    };
+  };
+in
+{
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  x86_64-linux = {
+    version = "2.11.3";
+    src = fetchurl {
+      url = "https://download.snipaste.com/archives/Snipaste-2.11.3-x86_64.AppImage";
+      hash = "sha256-6ARv8gRbZoul+sbXc9g3MTE6TwC6FxFHxvoaE4UkAzQ=";
+    };
+  };
+}

pkgs/by-name/sn/snipaste/update.sh

@@ -1,15 +1,52 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl coreutils jq common-updater-scripts
+#!nix-shell -i bash -p bash curl coreutils jq nix
 
-latestTag=$(curl -sSfL https://www.snipaste.com/linux_version | jq -r ".subject")
-latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; snipaste.version" | tr -d '"')
+set -euo pipefail
 
-if [[ "$latestVersion" == "$currentVersion" ]]; then
-    echo "package is up-to-date"
-    exit 0
-fi
+cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"
 
-prefetch=$(nix-prefetch-url "https://download.snipaste.com/archives/Snipaste-$latestVersion-x86_64.AppImage")
-hash=$(nix-hash --type sha256 --to-sri "$prefetch")
-update-source-version snipaste "$latestVersion" "$hash" --ignore-same-version
+linux_version=$(
+  curl -sSfL https://www.snipaste.com/linux_version \
+    | jq -r '.subject' \
+    | sed 's/^v//'
+)
+mac_version=$(
+  curl -sSfL https://www.snipaste.com/mac_version \
+    | jq -r '.subject' \
+    | sed 's/^v//'
+)
+
+linux_url="https://download.snipaste.com/archives/Snipaste-${linux_version}-x86_64.AppImage"
+mac_url="https://download.snipaste.com/archives/Snipaste-${mac_version}.dmg"
+
+linux_hash=$(nix-prefetch-url "$linux_url")
+mac_hash=$(nix-prefetch-url "$mac_url")
+
+linux_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$linux_hash")
+mac_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$mac_hash")
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{ fetchurl }:
+let
+  any-darwin = {
+    version = "$mac_version";
+    src = fetchurl {
+      url = "$mac_url";
+      hash = "$mac_hash";
+    };
+  };
+in
+{
+  aarch64-darwin = any-darwin;
+  x86_64-darwin = any-darwin;
+  x86_64-linux = {
+    version = "$linux_version";
+    src = fetchurl {
+      url = "$linux_url";
+      hash = "$linux_hash";
+    };
+  };
+}
+EOF

pkgs/by-name/ta/taisei/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
   # Build depends
   docutils,
   meson,
@@ -13,10 +14,14 @@
   gamemode,
   shaderc,
   makeWrapper,
+  cmake,
+  mimalloc,
+  glslang,
+  libogg,
+  makeBinaryWrapper,
+
   # Runtime depends
-  glfw,
   sdl3,
-  SDL2_mixer,
   cglm,
   freetype,
   libpng,
@@ -24,10 +29,10 @@
   zlib,
   zstd,
   spirv-cross,
-  mimalloc,
 
   gamemodeSupport ? stdenv.hostPlatform.isLinux,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "taisei";
   version = "1.4.4";
@@ -49,12 +54,12 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.zstandard
     shaderc
     makeWrapper
+    makeBinaryWrapper
+    cmake
   ];
 
   buildInputs = [
-    glfw
     sdl3
-    SDL2_mixer
     cglm
     freetype
     libpng
@@ -63,30 +68,48 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
     opusfile
     openssl
-    spirv-cross
     mimalloc
+    libogg
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    glslang
+    spirv-cross
   ]
   ++ lib.optional gamemodeSupport gamemode;
 
+  # Forced to use builtin-sincos because the symbol isn't available otherwise
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin " -Dsincos=__builtin_sincos";
+
   mesonFlags = [
-    (lib.mesonBool "b_lto" false)
-    (lib.mesonEnable "install_macos_bundle" false)
-    (lib.mesonEnable "install_relocatable" false)
-    (lib.mesonEnable "shader_transpiler" false)
-    (lib.mesonEnable "shader_transpiler_dxbc" false)
-    (lib.mesonEnable "gamemode" gamemodeSupport)
-    (lib.mesonEnable "package_data" false)
     (lib.mesonEnable "vfs_zip" false)
+    (lib.mesonEnable "shader_transpiler_dxbc" false)
+    (lib.mesonEnable "package_data" false)
+    (lib.mesonBool "b_lto" false)
+    (lib.mesonEnable "gamemode" gamemodeSupport)
+    (lib.mesonEnable "install_freedesktop" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "install_macos_bundle" stdenv.hostPlatform.isDarwin)
+    (lib.mesonEnable "install_relocatable" stdenv.hostPlatform.isDarwin)
+    (lib.mesonEnable "shader_transpiler" stdenv.hostPlatform.isDarwin)
   ];
 
   preConfigure = ''
     patchShebangs .
   '';
 
-  postInstall = lib.optionalString gamemodeSupport ''
-    wrapProgram $out/bin/taisei \
-      --set LD_LIBRARY_PATH ${lib.makeLibraryPath [ gamemode ]}
-  '';
+  postInstall =
+    lib.optionalString (stdenv.hostPlatform.isLinux && gamemodeSupport) ''
+      wrapProgram $out/bin/taisei \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ gamemode ]}"
+    ''
+    +
+
+      lib.optionalString stdenv.hostPlatform.isDarwin ''
+        mkdir -p $out/Applications $out/bin
+
+        mv $out/Taisei.app $out/Applications/
+        # regular symlink will fail here due to resources being missed
+        makeBinaryWrapper $out/Applications/Taisei.app/Contents/MacOS/Taisei $out/bin/taisei
+      '';
 
   strictDeps = true;
 
@@ -106,7 +129,9 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       lambda-11235
       Gliczy
+      philocalyst
     ];
     platforms = lib.platforms.all;
+    changelog = "https://github.com/taisei-project/taisei/releases/tag/${finalAttrs.src.tag}";
   };
 })

pkgs/by-name/wr/wrangler/package.nix

@@ -16,6 +16,7 @@
   moreutils,
   nix-update-script,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
@@ -119,7 +120,9 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
+    writableTmpDirAsHomeHook
   ];
+  versionCheckKeepEnvironment = [ "HOME" ];
 
   preFixup = ''
     # fixupPhase spends a lot of time trying to strip text files, which is especially slow on Darwin

pkgs/tools/networking/openvpn/default.nix

@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvpn";
-  version = "2.6.19";
+  version = "2.6.21";
 
   src = fetchurl {
     url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-E3AlJvaHwYslQMGj8uGJGHuqplIR7c9/9ncvpp8FNs8=";
+    hash = "sha256-JMthheVEpHMj1nmLA9OfI2fZbyJ77pzRVD6O1Sgxmxc=";
   };
 
   nativeBuildInputs = [