lib.types.attrNamesTo{Set,Submodule}: add

(cherry picked from commit 98652f9a90)

.github/workflows/backport.yml

@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   backport:
     name: Backport Pull Request
-    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
     runs-on: ubuntu-24.04-arm
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered

.github/workflows/check-cherry-picks.yml

@@ -1,6 +1,9 @@
 name: "Check cherry-picks"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-cherry-picks.yml
   pull_request_target:
     branches:
       - 'release-**'
@@ -13,7 +16,6 @@ jobs:
   check:
     name: cherry-pick-check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/check-format.yml

@@ -1,6 +1,9 @@
 name: Check that files are formatted
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-format.yml
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
 

.github/workflows/check-shell.yml

@@ -1,6 +1,9 @@
 name: "Check shell"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-shell.yml
   pull_request_target:
     paths:
       - 'shell.nix'

.github/workflows/codeowners-v2.yml

@@ -23,6 +23,9 @@
 name: Codeowners v2
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/codeowners-v2.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
@@ -64,6 +67,7 @@ jobs:
         run: nix-build base/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -77,6 +81,7 @@ jobs:
           path: pr
 
       - name: Validate codeowners
+        if: steps.app-token.outputs.token
         run: result/bin/codeowners-validator
         env:
           OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
@@ -99,6 +104,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,6 +117,7 @@ jobs:
         run: nix-build ci -A requestReviews
 
       - name: Request reviews
+        if: steps.app-token.outputs.token
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/eval-aliases.yml

@@ -1,6 +1,9 @@
 name: Eval aliases
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval-aliases.yml
   pull_request_target:
 
 permissions: {}
@@ -26,7 +29,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - name: Ensure flake outputs on all systems still evaluate
-        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
+        run: nix flake check --all-systems --no-build ./nixpkgs
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |

.github/workflows/eval.yml

@@ -1,6 +1,9 @@
 name: Eval
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened]
   push:
@@ -166,7 +169,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-24.04-arm
-    needs: [ process ]
+    needs: [ get-merge-commit, process ]
     if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write
@@ -175,6 +178,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -205,6 +209,7 @@ jobs:
         run: nix-build base/ci -A requestReviews
 
       - name: Labelling pull request
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           # Get all currently set rebuild labels
           gh api \
@@ -239,7 +244,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           description=$(jq -r '
           "Package: added " + (.attrdiff.added | length | tostring) +
@@ -259,6 +264,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Requesting maintainer reviews
+        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
         run: |
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs

.github/workflows/get-merge-commit.yml

@@ -1,6 +1,9 @@
 name: Get merge commit
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/get-merge-commit.yml
   workflow_call:
     outputs:
       mergedSha:
@@ -38,9 +41,9 @@ jobs:
             push)
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
-            pull_request_target)
+            pull_request*)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the commits:\n$commits"
+                echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"
               else
                 # Skipping so that no notifications are sent

.github/workflows/lib-tests.yml

@@ -1,6 +1,9 @@
 name: "Building Nixpkgs lib-tests"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/lib-tests.yml
   pull_request_target:
     paths:
       - 'lib/**'

.github/workflows/manual-nixos-v2.yml

@@ -1,6 +1,9 @@
 name: "Build NixOS manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixos-v2.yml
   pull_request_target:
     branches:
       - master
@@ -38,7 +41,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,6 +1,9 @@
 name: "Build Nixpkgs manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
     branches:
       - master
@@ -25,7 +28,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/nix-parse-v2.yml

@@ -1,6 +1,9 @@
 name: "Check whether nix files are parseable v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nix-parse-v2.yml
   pull_request_target:
 
 permissions: {}

.github/workflows/nixpkgs-vet.yml

@@ -6,6 +6,9 @@
 name: Vet nixpkgs
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
     # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
     # Instead it causes an `edited` event, so we need to add it explicitly here.

.github/workflows/no-channel.yml

@@ -1,6 +1,9 @@
 name: "No channel PR"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/no-channel.yml
   pull_request_target:
     # Re-run should be triggered when the base branch is updated, instead of silently failing
     types: [opened, synchronize, reopened, edited]

.github/workflows/periodic-merge-24h.yml

@@ -31,6 +31,10 @@ jobs:
             into: staging-next-24.11
           - from: staging-next-24.11
             into: staging-24.11
+          - from: master
+            into: staging-next-25.05
+          - from: staging-next-25.05
+            into: staging-25.05
           - from: master staging
             into: haskell-updates
     uses: ./.github/workflows/periodic-merge.yml

ci/OWNERS

@@ -171,6 +171,11 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /pkgs/top-level/python-packages.nix                     @natsukium
 /pkgs/top-level/release-python.nix                      @natsukium
 
+# CUDA
+/pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
+/pkgs/top-level/release-cuda.nix              @NixOS/cuda-maintainers
+/pkgs/development/cuda-modules                @NixOS/cuda-maintainers
+
 # Haskell
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
 /maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
@@ -304,8 +309,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/dlang @jtbx @TomaSajt
 
 # Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
+/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
+/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
 
 # Idris
 /pkgs/development/idris-modules @Infinisil
@@ -379,12 +384,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # Xfce
 /doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce
 
-# nim
-/doc/languages-frameworks/nim.section.md  @ehmry
-/pkgs/build-support/build-nim-package.nix @ehmry
-/pkgs/build-support/build-nim-sbom.nix    @ehmry
-/pkgs/top-level/nim-overrides.nix         @ehmry
-
 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq
 

ci/default.nix

@@ -63,10 +63,7 @@ let
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
-        fileset = fs.difference (fs.unions [
-          (fs.fileFilter (file: file.hasExt "nix") ../.)
-          ../.git-blame-ignore-revs
-        ]) (fs.maybeMissing ../.git);
+        fileset = fs.difference ../. (fs.maybeMissing ../.git);
       };
     in
     {

ci/pinned-nixpkgs.json

@@ -1,4 +1,4 @@
 {
-  "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a",
-  "sha256": "0qg99zj0gb0pc6sjlkmwhk1c1xz14qxmk6gamgfmcxpsfdp5vn72"
+  "rev": "eaeed9530c76ce5f1d2d8232e08bec5e26f18ec1",
+  "sha256": "132nimgi1g88fbhddk4b8b1qk68jly494x2mnphyk3xa1d2wy9q7"
 }

doc/hooks/installShellFiles.section.md

@@ -99,17 +99,12 @@ failure. To prevent this, guard the completion generation commands.
 ```nix
 {
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
-    let
-      emulator = stdenv.hostPlatform.emulator buildPackages;
-    in
-    ''
-      # using named fd
-      installShellCompletion --cmd foobar \
-        --bash <(${emulator} $out/bin/foobar --bash-completion) \
-        --fish <(${emulator} $out/bin/foobar --fish-completion) \
-        --zsh <(${emulator} $out/bin/foobar --zsh-completion)
-    ''
-  );
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # using named fd
+    installShellCompletion --cmd foobar \
+      --bash <($out/bin/foobar --bash-completion) \
+      --fish <($out/bin/foobar --fish-completion) \
+      --zsh <($out/bin/foobar --zsh-completion)
+  '';
 }
 ```

doc/languages-frameworks/haskell.section.md

@@ -779,7 +779,7 @@ that depend on that library, you may want to use:
 
 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_1_1;
+  Cabal = self.Cabal_3_14_2_0;
 })
 ```
 

doc/release-notes/rl-2511.section.md

@@ -0,0 +1,37 @@
+# Nixpkgs 25.11 (2025.11/??) {#sec-nixpkgs-release-25.11}
+
+## Highlights {#sec-nixpkgs-release-25.11-highlights}
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+### Breaking changes {#sec-nixpkgs-release-25.11-lib-breaking}
+
+- Create the first release note entry in this section!
+
+
+### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}
+
+- Create the first release note entry in this section!
+
+
+### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
+
+- Create the first release note entry in this section!
+

doc/stdenv/stdenv.chapter.md

@@ -1141,12 +1141,15 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.
 
 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.
 
+However, `makeWrapper` is more flexible and implements more arguments.
+Use `makeWrapper` if you need the wrapper to use shell features (e.g. look up environment variables) at runtime.
+
 ### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}
 
 Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.

lib/asserts.nix

@@ -1,5 +1,16 @@
 { lib }:
 
+let
+  inherit (lib.strings)
+    concatStringsSep
+    ;
+  inherit (lib.lists)
+    filter
+    ;
+  inherit (lib.trivial)
+    showWarnings
+    ;
+in
 rec {
 
   /**
@@ -131,4 +142,61 @@ rec {
       "each element in ${name} must be one of ${lib.generators.toPretty { } xs}, but is: ${
         lib.generators.toPretty { } vals
       }";
+
+  /**
+    Wrap a value with logic that throws an error when assertions
+    fail and emits any warnings.
+
+    # Inputs
+
+    `assertions`
+
+    : A list of assertions. If any of their `assertion` attrs is `false`, their `message` attrs will be emitted in a `throw`.
+
+    `warnings`
+
+    : A list of strings to emit as warnings. This function does no filtering on this list.
+
+    `val`
+
+    : A value to return, wrapped in `warn`, if a `throw` is not necessary.
+
+    # Type
+
+    ```
+    checkAssertWarn :: [ { assertion :: Bool; message :: String } ] -> [ String ] -> Any -> Any
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.asserts.checkAssertWarn` usage example
+    ```nix
+    checkAssertWarn
+      [ { assertion = false; message = "Will fail"; } ]
+      [ ]
+      null
+    stderr>        error:
+    stderr>        Failed assertions:
+    stderr>        - Will fail
+
+    checkAssertWarn
+      [ { assertion = true; message = "Will not fail"; } ]
+      [ "Will warn" ]
+      null
+    stderr> evaluation warning: Will warn
+    null
+    ```
+
+    :::
+  */
+  checkAssertWarn =
+    assertions: warnings: val:
+    let
+      failedAssertions = map (x: x.message) (filter (x: !x.assertion) assertions);
+    in
+    if failedAssertions != [ ] then
+      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
+    else
+      showWarnings warnings val;
+
 }

lib/licenses.nix

@@ -651,6 +651,11 @@ lib.mapAttrs mkLicense (
       url = "https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception";
     };
 
+    gpl2UBDLPlus = {
+      fullName = "GNU General Public License v3.0 or later (with UBDL exception)";
+      url = "https://spdx.org/licenses/UBDL-exception.html";
+    };
+
     gpl2Oss = {
       fullName = "GNU General Public License version 2 only (with OSI approved licenses linking exception)";
       url = "https://www.mysql.com/about/legal/licensing/foss-exception";

lib/path/default.nix

@@ -382,7 +382,7 @@ in
               (splitRoot p).root
               (splitRoot p).subpath
 
-    - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
+    - Trying to get the parent directory of `root` using [`dirOf`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-dirOf) returns `root` itself:
 
           dirOf (splitRoot p).root == (splitRoot p).root
 

lib/systems/default.nix

@@ -352,21 +352,9 @@ let
             else
               null;
 
-          # Remove before 25.05
-          androidSdkVersion =
-            if (args ? sdkVer && !args ? androidSdkVersion) then
-              throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
-            else if (args ? androidSdkVersion) then
-              args.androidSdkVersion
-            else
-              null;
-          androidNdkVersion =
-            if (args ? ndkVer && !args ? androidNdkVersion) then
-              throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
-            else if (args ? androidSdkVersion) then
-              args.androidNdkVersion
-            else
-              null;
+          # Handle Android SDK and NDK versions.
+          androidSdkVersion = args.androidSdkVersion or null;
+          androidNdkVersion = args.androidNdkVersion or null;
         }
         // (
           let

lib/systems/examples.nix

@@ -146,6 +146,10 @@ rec {
   riscv64 = riscv "64";
   riscv32 = riscv "32";
 
+  riscv64-musl = {
+    config = "riscv64-unknown-linux-musl";
+  };
+
   riscv64-embedded = {
     config = "riscv64-none-elf";
     libc = "newlib";

lib/tests/modules.sh

@@ -160,6 +160,9 @@ checkConfigError 'A definition for option .intStrings\.badTagTypeError\.left. is
 checkConfigError 'A definition for option .nested\.right\.left. is not of type .signed integer.' config.nested.right.left ./types-attrTag.nix
 checkConfigError 'In attrTag, each tag value must be an option, but tag int was a bare type, not wrapped in mkOption.' config.opt.int ./types-attrTag-wrong-decl.nix
 
+# types.nix assertions
+checkConfigOutput '"ok"' config.check ./types.nix
+
 # types.pathInStore
 checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
 checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix

lib/tests/modules/types.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ config, lib, ... }:
 let
   inherit (builtins)
     storeDir
@@ -7,10 +7,24 @@ let
     types
     mkOption
     ;
+
+  m = {
+    options = {
+      enableQux = mkOption {
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
 in
 {
   options = {
+    check = mkOption { };
+    # NB: types are tested in multiple places, so this list is far from exhaustive
     pathInStore = mkOption { type = types.lazyAttrsOf types.pathInStore; };
+    attrNamesToTrue = mkOption { type = types.lazyAttrsOf types.attrNamesToTrue; };
+    attrNamesToSet = mkOption { type = types.lazyAttrsOf types.attrNamesToSet; };
+    attrNamesToSubmodules = mkOption { type = types.lazyAttrsOf (types.attrNamesToSubmodules m); };
   };
   config = {
     pathInStore.ok1 = "${storeDir}/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
@@ -21,5 +35,112 @@ in
     pathInStore.bad3 = "${storeDir}/";
     pathInStore.bad4 = "${storeDir}/.links"; # technically true, but not reasonable
     pathInStore.bad5 = "/foo/bar";
+    attrNamesToTrue.justNames = [
+      "a"
+      "b"
+      "c"
+    ];
+    attrNamesToTrue.mixed = lib.mkMerge [
+      {
+        a = true;
+        b = false;
+      }
+      [ "c" ]
+    ];
+    attrNamesToTrue.trivial = {
+      a = true;
+      b = false;
+      c = true;
+    };
+    attrNamesToSet.justNames = [
+      "a"
+      "b"
+      "c"
+    ];
+    attrNamesToSet.mixed = lib.mkMerge [
+      {
+        a = { };
+        b = { };
+      }
+      [ "c" ]
+    ];
+    attrNamesToSet.trivial = {
+      a = { };
+      b = { };
+      c = { };
+    };
+    attrNamesToSubmodules.justNames = [
+      "a"
+      "b"
+      "c"
+    ];
+    attrNamesToSubmodules.mixed = lib.mkMerge [
+      {
+        a = { };
+        b.enableQux = true;
+      }
+      [ "c" ]
+    ];
+    attrNamesToSubmodules.trivial = {
+      a = { };
+      b.enableQux = true;
+      c = { };
+    };
+    check =
+      assert
+        config.attrNamesToTrue.justNames == {
+          a = true;
+          b = true;
+          c = true;
+        };
+      assert
+        config.attrNamesToTrue.mixed == {
+          a = true;
+          b = false;
+          c = true;
+        };
+      assert
+        config.attrNamesToTrue.trivial == {
+          a = true;
+          b = false;
+          c = true;
+        };
+      assert
+        config.attrNamesToSet.justNames == {
+          a = { };
+          b = { };
+          c = { };
+        };
+      assert
+        config.attrNamesToSet.mixed == {
+          a = { };
+          b = { };
+          c = { };
+        };
+      assert
+        config.attrNamesToSet.trivial == {
+          a = { };
+          b = { };
+          c = { };
+        };
+      assert
+        config.attrNamesToSubmodules.justNames == {
+          a.enableQux = false;
+          b.enableQux = false;
+          c.enableQux = false;
+        };
+      assert
+        config.attrNamesToSubmodules.mixed == {
+          a.enableQux = false;
+          b.enableQux = true;
+          c.enableQux = false;
+        };
+      assert
+        config.attrNamesToSubmodules.trivial == {
+          a.enableQux = false;
+          b.enableQux = true;
+          c.enableQux = false;
+        };
+      "ok";
   };
 }

lib/types.nix

@@ -1456,6 +1456,23 @@ let
           nestedTypes.finalType = finalType;
         };
 
+      # Tests: lib/tests/modules/types.nix
+      # Docs: nixos/doc/manual/development/option-types.section.md
+      # Docs: https://nixos.org/manual/nixos/unstable/#sec-option-types-basic
+      attrNamesToTrue = coercedTo (types.listOf types.str) (
+        enabledList: lib.genAttrs enabledList (_attrName: true)
+      ) (types.attrsOf types.bool);
+
+      # Tests: lib/tests/modules.sh, lib/tests/modules/types.nix
+      # Docs: nixos/doc/manual/development/option-types.section.md
+      # Docs: https://nixos.org/manual/nixos/unstable/#sec-option-types-basic
+      attrNamesToSet = attrNamesToSubmodules { };
+      attrNamesToSubmodules =
+        m:
+        coercedTo (types.listOf types.str) (enabledList: lib.genAttrs enabledList (_attrName: { })) (
+          types.attrsOf (types.submodule m)
+        );
+
       # Augment the given type with an additional type check function.
       addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
 

maintainers/maintainer-list.nix

@@ -53,8 +53,7 @@
    More fields may be added in the future, however, in order to comply with GDPR this file should stay as minimal as possible.
 
    When editing this file:
-    * keep the list alphabetically sorted, check with:
-        nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix
+    * keep the list alphabetically sorted
     * test the validity of the format with:
         nix-build lib/tests/maintainers.nix
 
@@ -537,6 +536,12 @@
       }
     ];
   };
+  Acconut = {
+    email = "marius@transloadit.com";
+    github = "Acconut";
+    githubId = 1375043;
+    name = "Marius Kleidl";
+  };
   acesyde = {
     name = "Pierre-Emmanuel Mercier";
     email = "acesyde@gmail.com";
@@ -1854,6 +1859,12 @@
     name = "Austin Lund";
     keys = [ { fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE"; } ];
   };
+  appleboblin = {
+    email = "github@appleboblin.com";
+    github = "appleboblin";
+    githubId = 16847957;
+    name = "Po-Hui Lin";
+  };
   applejag = {
     email = "applejag.luminance905@passmail.com";
     github = "applejag";
@@ -5802,7 +5813,7 @@
     email = "me@dblsaiko.net";
     github = "2xsaiko";
     githubId = 3987560;
-    name = "Marco Rebhan";
+    name = "Katalin Rebhan";
   };
   dbohdan = {
     email = "dbohdan@dbohdan.com";
@@ -5841,6 +5852,11 @@
     githubId = 39909293;
     name = "Dominic Delabruere";
   };
+  ddogfoodd = {
+    github = "ddogfoodd";
+    githubId = 58050402;
+    name = "Jost Alemann";
+  };
   dduan = {
     email = "daniel@duan.ca";
     github = "dduan";
@@ -8548,6 +8564,12 @@
     githubId = 21362942;
     name = "Fugi";
   };
+  fullmetalsheep = {
+    email = "fullmetalsheep@proton.me";
+    github = "fullmetalsheep";
+    githubId = 23723926;
+    name = "Dash R";
+  };
   funkeleinhorn = {
     email = "git@funkeleinhorn.com";
     github = "funkeleinhorn";
@@ -11347,6 +11369,13 @@
     githubId = 19669567;
     name = "Willy";
   };
+  jennifgcrl = {
+    email = "jennifer@jezh.me";
+    github = "jennifgcrl";
+    githubId = 110419915;
+    matrix = "@fgcrl:matrix.org";
+    name = "Jennifer Zhou";
+  };
   jensbin = {
     email = "jensbin+git@pm.me";
     github = "jensbin";
@@ -11391,6 +11420,17 @@
     githubId = 10786794;
     name = "Markus Hihn";
   };
+  jess = {
+    name = "Jessica";
+    email = "jess+nix@jessie.cafe";
+    github = "ttrssreal";
+    githubId = 43591752;
+    keys = [
+      {
+        fingerprint = "8092 3BD1 ECD0 E436 671D  C8E9 BA33 5068 6C91 8606";
+      }
+    ];
+  };
   jessemoore = {
     email = "jesse@jessemoore.dev";
     github = "jesseDMoore1994";
@@ -11582,6 +11622,12 @@
     githubId = 9866621;
     name = "Jack";
   };
+  jkachmar = {
+    email = "git@jkachmar.com";
+    github = "jkachmar";
+    githubId = 8461423;
+    name = "jkachmar";
+  };
   jkarlson = {
     email = "jekarlson@gmail.com";
     github = "ethorsoe";
@@ -12669,6 +12715,12 @@
     githubId = 37185887;
     name = "Calvin Kim";
   };
+  keegancsmith = {
+    email = "keegan.csmith@gmail.com";
+    name = "Keegan Carruthers-Smith";
+    github = "keegancsmith";
+    githubId = 187831;
+  };
   keenanweaver = {
     email = "keenanweaver@protonmail.com";
     name = "Keenan Weaver";
@@ -13417,6 +13469,12 @@
     githubId = 58425080;
     name = "Viktor Pocedulić";
   };
+  kvz = {
+    email = "kevin@transloadit.com";
+    github = "kvz";
+    githubId = 26752;
+    name = "Kevin van Zonneveld";
+  };
   kwaa = {
     name = "藍+85CD";
     email = "kwa@kwaa.dev";
@@ -18486,6 +18544,12 @@
     github = "ovlach";
     githubId = 4405107;
   };
+  owickstrom = {
+    email = "oskar@wickstrom.tech";
+    name = "Oskar Wickström";
+    github = "owickstrom";
+    githubId = 1464328;
+  };
   oxalica = {
     email = "oxalicc@pm.me";
     github = "oxalica";
@@ -24070,6 +24134,12 @@
     github = "tebriel";
     githubId = 821688;
   };
+  tebro = {
+    email = "git@tebro.simplelogin.com";
+    name = "Richard Weber";
+    github = "Tebro";
+    githubId = 3861339;
+  };
   techknowlogick = {
     email = "techknowlogick@gitea.com";
     github = "techknowlogick";
@@ -26838,6 +26908,12 @@
     githubId = 15948162;
     name = "Yanni Papandreou";
   };
+  yarekt = {
+    name = "Yarek T";
+    email = "yarekt+nixpkgs@gmail.com";
+    github = "yarektyshchenko";
+    githubId = 185304;
+  };
   yarny = {
     github = "Yarny0";
     githubId = 41838844;

maintainers/scripts/luarocks-packages.csv

@@ -106,7 +106,6 @@ luazip,,,,,,
 lusc_luv,,,,,,
 lush.nvim,,,https://luarocks.org/dev,,,teto
 luuid,,,,20120509-2,,
-luv,,,,1.48.0-2,,
 lyaml,,,,,,lblasc
 lz.n,,,,,,mrcjkb
 lze,,,,,,birdee

maintainers/team-list.nix

@@ -843,6 +843,7 @@ with lib.maintainers;
       Gabriella439
       curran
       lf-
+      jkachmar
     ];
     scope = "Group registry for packages maintained by Mercury";
     shortName = "Mercury Employees";

nixos/doc/manual/development/option-types.section.md

@@ -135,6 +135,79 @@ merging is handled.
     problems.
     :::
 
+`types.attrNamesToTrue`
+
+:   Either a list of attribute names, or an attribute set of
+    booleans. A list will be coerced into an attribute set with those
+    names, whose values are set to `true`. This is useful when it is
+    convenient to be able to write definitions as a simple list, but
+    still need to be able to override and disable individual values.
+
+    If configurability of the items is needed or `false` is not a
+    desirable value, prefer `types.attrNamesToSubmodule` or `types.attrNamesToSet`.
+
+    ::: {#ex-types-attrNamesToTrue .example}
+    ### `types.attrNamesToTrue`
+    ```
+    {
+      foo = [ "bar" ];
+    }
+    ```
+
+    ```
+    {
+      foo.bar = true;
+    }
+    ```
+    :::
+
+`types.attrNamesToSet`
+
+:   Either a list of attribute names, or an attribute set of `{ }`.
+    This is similar to `types.attrNamesToTrue`, but `false` is not a permitted
+    value. This is useful when that's not an expected value, and by using this
+    type, you have the option to upgrade the type to `types.attrNamesToSubmodule`
+    without breaking anything.
+
+    ::: {#ex-types-attrNamesToSet .example}
+    ### `types.attrNamesToSet`
+    ```
+    {
+      foo = [ "bar" ];
+    }
+    ```
+
+    ```
+    {
+      foo.bar = { };
+    }
+    ```
+    :::
+
+`types.attrNamesToSubmodule` *`submodule`*
+
+:   Either a list of attribute names, or an attribute set of submodules.
+    This is similar to `types.attrNamesToSet`, but the values are submodules
+    instead of empty sets. This is useful when the values of this type are
+    optionally configurable.
+
+    ::: {#ex-types-attrNamesToSubmodule .example}
+    ### `types.attrNamesToSubmodule`
+    ```
+    {
+      foo = [ "bar" ];
+    }
+    ```
+
+    ```
+    {
+      foo.bar = { };
+      foo.baz.enableQux = true;
+    }
+    ```
+    :::
+
+
 `types.pkgs`
 
 :   A type for the top level Nixpkgs package set.

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -71,10 +71,19 @@ An SSH-based backdoor to log into machines can be enabled with
 {
   name = "…";
   nodes.machines = { /* … */ };
-  sshBackdoor.enable = true;
+  interactive.sshBackdoor.enable = true;
 }
 ```
 
+::: {.warning}
+Make sure to only enable the backdoor for interactive tests
+(i.e. by using `interactive.sshBackdoor.enable`)! This is the only
+supported configuration.
+
+Running a test in a sandbox with this will fail because `/dev/vhost-vsock` isn't available
+in the sandbox.
+:::
+
 This creates a [vsock socket](https://man7.org/linux/man-pages/man7/vsock.7.html)
 for each VM to log in with SSH. This configures root login with an empty password.
 

nixos/doc/manual/installation/installing-virtualbox-guest.section.md

@@ -8,7 +8,7 @@ up a VirtualBox guest, follow these instructions:
 
 1.  Base Memory Size: 768 MB or higher.
 
-1.  New Hard Disk of 8 GB or higher.
+1.  New Hard Disk of 10 GB or higher.
 
 1.  Mount the CD-ROM with the NixOS ISO (by clicking on CD/DVD-ROM)
 

nixos/doc/manual/redirects.json

@@ -1874,6 +1874,9 @@
   "test-opt-meta.platforms": [
     "index.html#test-opt-meta.platforms"
   ],
+  "test-opt-meta.hydraPlatforms": [
+    "index.html#test-opt-meta.hydraPlatforms"
+  ],
   "test-opt-meta.timeout": [
     "index.html#test-opt-meta.timeout"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -22,21 +22,17 @@
 
 - OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
 
-- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.
+- GNOME has been updated to version 48.
 
-- The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:
-  - [](#opt-services.mattermost.preferNixConfig) now defaults to true if you advance [](#opt-system.stateVersion) to 25.05. This means that if you have [](#opt-services.mattermost.mutableConfig) set, NixOS will override your settings to those that you define in the module. It is recommended to leave this at the default, even if you used a mutable config before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
-  - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior.
-  - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05.
-  - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`.
-  - The Mattermost frontend is now built from source and can be overridden.
-    - Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now.
-  - `services.mattermost.listenAddress` has been split into [](#opt-services.mattermost.host) and [](#opt-services.mattermost.port). If your `listenAddress` contained a port, you will need to edit your configuration.
-  - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating [](#opt-system.stateVersion) to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
-  - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
-  - We now support `mmctl` for Mattermost administration if both [](#opt-services.mattermost.socket.enable) and [](#opt-services.mattermost.socket.export) are set, which export the Mattermost control socket path into the system environment.
-  - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
-  - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
+  - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
+  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
+  - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
+  - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
+  - `cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.
+
+  Refer to the [GNOME release notes](https://release.gnome.org/48/) for more details.
+
+- The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
@@ -44,7 +40,10 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- [AmneziaVPN](https://amnezia.org/en), an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server. Available as [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable).
+- [AmneziaVPN](https://amnezia.org/en), a self-hostable open-source VPN client, is available in two variants:
+  - [programs.amnezia-vpn](#opt-programs.amnezia-vpn.enable): a GUI client which can also deploy a VPN endpoint to a remote server
+  - {option}`networking.wireguard` adds support for the [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) variant of the protocol, featuring better masking against Deep Packet Inspection. The variant to be used is set per interface as `networking.wireguard.interfaces.<name>.type`, defaulting to wireguard.
+
 
 - [Bazecor](https://github.com/Dygmalab/Bazecor), the graphical configurator for Dygma Products.
 
@@ -58,6 +57,8 @@
 
 - [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
 
+- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
+
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
 - [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
@@ -299,6 +300,8 @@
     After you run ALTER EXTENSION, you must run [this SQL script](https://github.com/timescale/timescaledb-extras/blob/master/utils/2.15.X-fix_hypertable_foreign_keys.sql). For more details, see the following pull requests [#6797](https://github.com/timescale/timescaledb/pull/6797).
     PostgreSQL 13 is no longer supported in TimescaleDB v2.16.
 
+- `networking.wireguard.enable = true` does not always add `wireguard-tools` to system packages anymore. Only when wireguard interfaces are configured, the backing implementation packages are added to system PATH.
+
 - `virtualisation/azure-common.nix`'s filesystem and grub configurations have been moved to `virtualisation/azure-image.nix`. This makes `azure-common.nix` more generic so it could be used for users who generate Azure image using other methods (e.g. nixos-generators and disko). For existing users depending on these configurations, please also import `azure-image.nix`.
 
 - `zammad` has had its support for MySQL removed, since it was never working correctly and is now deprecated upstream. Check the [migration guide](https://docs.zammad.org/en/latest/appendix/migrate-to-postgresql.html) for how to convert your database to PostgreSQL.
@@ -337,6 +340,10 @@
 
 - `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.
 
+- `rocmPackages_6` has been updated to ROCm 6.3.
+
+- `rocmPackages_5` has been removed.
+
 - `rocmPackages.rocm-thunk` has been removed and its functionality has been integrated with the ROCm CLR. Use `rocmPackages.clr` instead.
 
 - `rocmPackages.clang-ocl` has been removed. [It was deprecated by AMD in 2023.](https://github.com/ROCm/clang-ocl)
@@ -349,6 +356,12 @@
   Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
   [migration guide](https://prometheus.io/docs/prometheus/3.1/migration/).
 
+- The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:
+  - `services.mattermost.listenAddress` has been split into [](#opt-services.mattermost.host) and [](#opt-services.mattermost.port). If your `listenAddress` contained a port, you will need to edit your configuration. This will be the only truly breaking change in this release for most configurations.
+  - [](#opt-services.mattermost.preferNixConfig) now defaults to true if you advance [](#opt-system.stateVersion) to 25.05. This means that if you have [](#opt-services.mattermost.mutableConfig) set, NixOS will override settings set in the Admin Console to those that you define in the module configuration. It is recommended to leave this at the default, even if you used a fully mutable configuration before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
+  - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating [](#opt-system.stateVersion) to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
+  - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
+
 - `kanata` was updated to v1.8.0, which introduces several breaking changes.
   See the release notes of
   [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) and
@@ -541,7 +554,7 @@
 
 - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
 
-- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
+- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes. The settings options have been modified to use an attrset, enabling configurations with multiple instances of the daemon running at once, eg, for two separate drive bays.
 
 - `nextcloud-news-updater` is unmaintained and was removed from nixpkgs.
 
@@ -603,6 +616,15 @@
   This allows packaging configuration to be overridden in a consistent manner by
   providing an alternative to `rec {}` syntax.
 
+- [Mattermost](#opt-services.mattermost.enable), a self-hosted chat collaboration platform supporting calls, playbooks, and boards, has been updated. It now has multiple versions, disabled telemetry, and a native frontend build in nixpkgs, removing all upstream prebuilt blobs.
+  - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
+  - Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at [`services.mattermost.telemetry`](#opt-services.mattermost.telemetry.enableDiagnostics) for options to control this behavior.
+  - The Mattermost frontend is now built from source and can be overridden. Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now.
+  - `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05.
+  - `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`.
+  - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
+  - We now support `mmctl` for Mattermost administration if both [](#opt-services.mattermost.socket.enable) and [](#opt-services.mattermost.socket.export) are set, which export the Mattermost control socket path into the system environment.
+
 - KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
   ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and
   [is removed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c01f664e4ca210823b7594b50669bbd9b0a3c3b0)

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -0,0 +1,25 @@
+# Release 25.11 (2025.11/??) {#sec-release-25.11}
+
+## Highlights {#sec-release-25.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## New Modules {#sec-release-25.11-new-modules}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-release-25.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!

nixos/lib/testing/default.nix

@@ -9,15 +9,13 @@ let
     };
   runTest =
     module:
-    # Infra issue: virtualization on darwin doesn't seem to work yet.
-    lib.addMetaAttrs { hydraPlatforms = lib.platforms.linux; }
-      (evalTest (
-        { config, ... }:
-        {
-          imports = [ module ];
-          result = config.test;
-        }
-      )).config.result;
+    (evalTest (
+      { config, ... }:
+      {
+        imports = [ module ];
+        result = config.test;
+      }
+    )).config.result;
 
   testModules = [
     ./call-test.nix

nixos/lib/testing/meta.nix

@@ -1,50 +1,61 @@
 { lib, ... }:
 let
-  inherit (lib) types mkOption;
+  inherit (lib) types mkOption literalMD;
 in
 {
   options = {
-    meta = lib.mkOption {
+    meta = mkOption {
       description = ''
         The [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes that will be set on the returned derivations.
 
         Not all [`meta`](https://nixos.org/manual/nixpkgs/stable/#chap-meta) attributes are supported, but more can be added as desired.
       '';
       apply = lib.filterAttrs (k: v: v != null);
-      type = types.submodule {
-        options = {
-          maintainers = lib.mkOption {
-            type = types.listOf types.raw;
-            default = [ ];
-            description = ''
-              The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
-            '';
+      type = types.submodule (
+        { config, ... }:
+        {
+          options = {
+            maintainers = mkOption {
+              type = types.listOf types.raw;
+              default = [ ];
+              description = ''
+                The [list of maintainers](https://nixos.org/manual/nixpkgs/stable/#var-meta-maintainers) for this test.
+              '';
+            };
+            timeout = mkOption {
+              type = types.nullOr types.int;
+              default = 3600; # 1 hour
+              description = ''
+                The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
+              '';
+            };
+            broken = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
+              '';
+            };
+            platforms = mkOption {
+              type = types.listOf types.raw;
+              default = lib.platforms.linux ++ lib.platforms.darwin;
+              description = ''
+                Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
+              '';
+            };
+            hydraPlatforms = mkOption {
+              type = types.listOf types.raw;
+              # Ideally this would default to `platforms` again:
+              # default = config.platforms;
+              default = lib.platforms.linux;
+              defaultText = literalMD "`lib.platforms.linux` only, as the `hydra.nixos.org` build farm does not currently support virtualisation on Darwin.";
+              description = ''
+                Sets the [`meta.hydraPlatforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-hydraPlatforms) attribute on the [{option}`test`](#test-opt-test) derivation.
+              '';
+            };
           };
-          timeout = lib.mkOption {
-            type = types.nullOr types.int;
-            default = 3600; # 1 hour
-            description = ''
-              The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
-            '';
-          };
-          broken = lib.mkOption {
-            type = types.bool;
-            default = false;
-            description = ''
-              Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
-            '';
-          };
-          platforms = lib.mkOption {
-            type = types.listOf types.raw;
-            # darwin could be added, but it would add VM tests that don't work on Hydra.nixos.org (so far)
-            # see https://github.com/NixOS/nixpkgs/pull/303597#issuecomment-2128782362
-            default = lib.platforms.linux;
-            description = ''
-              Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
-            '';
-          };
-        };
-      };
+        }
+      );
       default = { };
     };
   };

nixos/lib/testing/run.nix

@@ -43,27 +43,30 @@ in
   };
 
   config = {
-    rawTestDerivation = hostPkgs.stdenv.mkDerivation {
-      name = "vm-test-run-${config.name}";
+    rawTestDerivation =
+      assert lib.assertMsg (!config.sshBackdoor.enable)
+        "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
+      hostPkgs.stdenv.mkDerivation {
+        name = "vm-test-run-${config.name}";
 
-      requiredSystemFeatures =
-        [ "nixos-test" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
-        ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
+        requiredSystemFeatures =
+          [ "nixos-test" ]
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isLinux [ "kvm" ]
+          ++ lib.optionals hostPkgs.stdenv.hostPlatform.isDarwin [ "apple-virt" ];
 
-      buildCommand = ''
-        mkdir -p $out
+        buildCommand = ''
+          mkdir -p $out
 
-        # effectively mute the XMLLogger
-        export LOGFILE=/dev/null
+          # effectively mute the XMLLogger
+          export LOGFILE=/dev/null
 
-        ${config.driver}/bin/nixos-test-driver -o $out
-      '';
+          ${config.driver}/bin/nixos-test-driver -o $out
+        '';
 
-      passthru = config.passthru;
+        passthru = config.passthru;
 
-      meta = config.meta;
-    };
+        meta = config.meta;
+      };
     test = lib.lazyDerivation {
       # lazyDerivation improves performance when only passthru items and/or meta are used.
       derivation = config.rawTestDerivation;

nixos/modules/image/file-options.nix

@@ -9,6 +9,7 @@
     baseName = lib.mkOption {
       type = lib.types.str;
       default = "nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+      defaultText = lib.literalExpression "nixos-image-\${config.system.nixos.label}-\${pkgs.stdenv.hostPlatform.system}";
       description = ''
         Basename of the image filename without any extension (e.g. `image_1`).
       '';
@@ -29,6 +30,7 @@
     fileName = lib.mkOption {
       type = lib.types.str;
       default = "${config.image.baseName}.${config.image.extension}";
+      defaultText = lib.literalExpression "\${config.image.baseName}.\${config.image.extension}";
       description = ''
         Filename of the image including all extensions (e.g `image_1.raw` or
         `image_1.raw.zst`).
@@ -38,6 +40,7 @@
     filePath = lib.mkOption {
       type = lib.types.str;
       default = config.image.fileName;
+      defaultText = lib.literalExpression "config.image.fileName";
       description = ''
         Path of the image, relative to `$out` in `system.build.image`.
         While it defaults to `config.image.fileName`, it can be different for builders where

nixos/modules/image/repart.nix

@@ -3,6 +3,7 @@
 
 {
   config,
+  options,
   pkgs,
   lib,
   utils,
@@ -88,6 +89,31 @@ in
 {
   imports = [
     ./repart-verity-store.nix
+    ./file-options.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "image"
+        "repart"
+        "imageFileBasename"
+      ];
+      to = [
+        "image"
+        "baseName"
+      ];
+    })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2411;
+      from = [
+        "image"
+        "repart"
+        "imageFile"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options.image.repart = {
@@ -95,7 +121,7 @@ in
     name = lib.mkOption {
       type = lib.types.str;
       description = ''
-        Name of the image.
+          Name of the image.
 
         If this option is unset but config.system.image.id is set,
         config.system.image.id is used as the default value.
@@ -109,23 +135,6 @@ in
       description = "Version of the image";
     };
 
-    imageFileBasename = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      description = ''
-        Basename of the image filename without any extension (e.g. `image_1`).
-      '';
-    };
-
-    imageFile = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      description = ''
-        Filename of the image including all extensions (e.g `image_1.raw` or
-        `image_1.raw.zst`).
-      '';
-    };
-
     compression = {
       enable = lib.mkEnableOption "Image compression";
 
@@ -250,55 +259,37 @@ in
       '';
     };
 
+    assertions = lib.mkOption {
+      type = options.assertions.type;
+      default = [ ];
+      internal = true;
+      visible = false;
+      description = ''
+        Assertions only evaluated by the repart image, not by the system toplevel.
+      '';
+    };
+
+    warnings = lib.mkOption {
+      type = options.warnings.type;
+      default = [ ];
+      internal = true;
+      visible = false;
+      description = ''
+        Warnings only evaluated by the repart image, not by the system toplevel.
+      '';
+    };
+
   };
 
   config = {
-
-    assertions = lib.mapAttrsToList (
-      fileName: partitionConfig:
-      let
-        inherit (partitionConfig) repartConfig;
-        labelLength = builtins.stringLength repartConfig.Label;
-      in
-      {
-        assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
-        message = ''
-          The partition label '${repartConfig.Label}'
-          defined for '${fileName}' is ${toString labelLength} characters long,
-          but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
-        '';
-      }
-    ) cfg.partitions;
-
-    warnings = lib.filter (v: v != null) (
-      lib.mapAttrsToList (
-        fileName: partitionConfig:
-        let
-          inherit (partitionConfig) repartConfig;
-          suggestedMaxLabelLength = GPTMaxLabelLength - 2;
-          labelLength = builtins.stringLength repartConfig.Label;
-        in
-        if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
-          ''
-            The partition label '${repartConfig.Label}'
-            defined for '${fileName}' is ${toString labelLength} characters long.
-            The suggested maximum label length is ${toString suggestedMaxLabelLength}.
-
-            If you use sytemd-sysupdate style A/B updates, this might
-            not leave enough space to increment the version number included in
-            the label in a future release. For example, if your label is
-            ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
-            you're at version 9, you cannot increment this to 10.
-          ''
-        else
-          null
-      ) cfg.partitions
-    );
-
-    image.repart =
+    image.baseName =
       let
         version = config.image.repart.version;
         versionInfix = if version != null then "_${version}" else "";
+      in
+      cfg.name + versionInfix;
+    image.extension =
+      let
         compressionSuffix =
           lib.optionalString cfg.compression.enable
             {
@@ -308,6 +299,11 @@ in
             }
             ."${cfg.compression.algorithm}";
 
+      in
+      "raw" + compressionSuffix;
+
+    image.repart =
+      let
         makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };
 
         # Add the closure of the provided Nix store paths to cfg.partitions so
@@ -321,9 +317,6 @@ in
       in
       {
         name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
-        imageFileBasename = cfg.name + versionInfix;
-        imageFile = cfg.imageFileBasename + ".raw" + compressionSuffix;
-
         compression = {
           # Generally default to slightly faster than default compression
           # levels under the assumption that most of the building will be done
@@ -339,6 +332,47 @@ in
         };
 
         finalPartitions = lib.mapAttrs addClosure cfg.partitions;
+
+        assertions = lib.mapAttrsToList (
+          fileName: partitionConfig:
+          let
+            inherit (partitionConfig) repartConfig;
+            labelLength = builtins.stringLength repartConfig.Label;
+          in
+          {
+            assertion = repartConfig ? Label -> GPTMaxLabelLength >= labelLength;
+            message = ''
+              The partition label '${repartConfig.Label}'
+              defined for '${fileName}' is ${toString labelLength} characters long,
+              but the maximum label length supported by UEFI is ${toString GPTMaxLabelLength}.
+            '';
+          }
+        ) cfg.partitions;
+
+        warnings = lib.filter (v: v != null) (
+          lib.mapAttrsToList (
+            fileName: partitionConfig:
+            let
+              inherit (partitionConfig) repartConfig;
+              suggestedMaxLabelLength = GPTMaxLabelLength - 2;
+              labelLength = builtins.stringLength repartConfig.Label;
+            in
+            if (repartConfig ? Label && labelLength >= suggestedMaxLabelLength) then
+              ''
+                The partition label '${repartConfig.Label}'
+                defined for '${fileName}' is ${toString labelLength} characters long.
+                The suggested maximum label length is ${toString suggestedMaxLabelLength}.
+
+                If you use sytemd-sysupdate style A/B updates, this might
+                not leave enough space to increment the version number included in
+                the label in a future release. For example, if your label is
+                ${toString GPTMaxLabelLength} characters long (the maximum enforced by UEFI) and
+                you're at version 9, you cannot increment this to 10.
+              ''
+            else
+              null
+          ) cfg.partitions
+        );
       };
 
     system.build.image =
@@ -354,21 +388,22 @@ in
         );
 
         mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
+        val = pkgs.callPackage ./repart-image.nix {
+          systemd = cfg.package;
+          imageFileBasename = config.image.baseName;
+          inherit (cfg)
+            name
+            version
+            compression
+            split
+            seed
+            sectorSize
+            finalPartitions
+            ;
+          inherit fileSystems definitionsDirectory mkfsEnv;
+        };
       in
-      pkgs.callPackage ./repart-image.nix {
-        systemd = cfg.package;
-        inherit (cfg)
-          name
-          version
-          imageFileBasename
-          compression
-          split
-          seed
-          sectorSize
-          finalPartitions
-          ;
-        inherit fileSystems definitionsDirectory mkfsEnv;
-      };
+      lib.asserts.checkAssertWarn cfg.assertions cfg.warnings val;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/module-list.nix

@@ -160,6 +160,7 @@
   ./programs/arp-scan.nix
   ./programs/atop.nix
   ./programs/ausweisapp.nix
+  ./programs/autoenv.nix
   ./programs/autojump.nix
   ./programs/bandwhich.nix
   ./programs/bash-my-aws.nix
@@ -186,7 +187,6 @@
   ./programs/corefreq.nix
   ./programs/cpu-energy-meter.nix
   ./programs/criu.nix
-  ./programs/darling.nix
   ./programs/dconf.nix
   ./programs/digitalbitbox/default.nix
   ./programs/direnv.nix
@@ -1076,6 +1076,7 @@
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix
   ./services/networking/blocky.nix
+  ./services/networking/cato-client.nix
   ./services/networking/centrifugo.nix
   ./services/networking/cgit.nix
   ./services/networking/charybdis.nix
@@ -1608,6 +1609,7 @@
   ./services/web-apps/nostr-rs-relay.nix
   ./services/web-apps/ocis.nix
   ./services/web-apps/olivetin.nix
+  ./services/web-apps/oncall.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/openvscode-server.nix

nixos/modules/profiles/nix-builder-vm.nix

@@ -163,7 +163,7 @@ in
 
         hostPkgs = config.virtualisation.host.pkgs;
 
-        script = hostPkgs.writeShellScriptBin "create-builder" (
+        add-keys = hostPkgs.writeShellScriptBin "add-keys" (
           ''
             set -euo pipefail
           ''
@@ -191,10 +191,22 @@ in
             if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
               (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
             fi
-            KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
           ''
         );
 
+        run-builder = hostPkgs.writeShellScriptBin "run-builder" (''
+          set -euo pipefail
+          KEYS="''${KEYS:-./keys}"
+          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
+        '');
+
+        script = hostPkgs.writeShellScriptBin "create-builder" (''
+          set -euo pipefail
+          export KEYS="''${KEYS:-./keys}"
+          ${lib.getExe add-keys}
+          ${lib.getExe run-builder}
+        '');
+
       in
       script.overrideAttrs (old: {
         pos = __curPos; # sets meta.position to point here; see script binding above for package definition
@@ -205,6 +217,8 @@ in
           # Let users in the repl inspect the config
           nixosConfig = config;
           nixosOptions = options;
+
+          inherit add-keys run-builder;
         };
       });
 

nixos/modules/programs/darling.nix

@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.darling;
-in
-{
-  options = {
-    programs.darling = {
-      enable = lib.mkEnableOption "Darling, a Darwin/macOS compatibility layer for Linux";
-      package = lib.mkPackageOption pkgs "darling" { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    security.wrappers.darling = {
-      source = lib.getExe cfg.package;
-      owner = "root";
-      group = "root";
-      setuid = true;
-    };
-  };
-}

nixos/modules/programs/nm-applet.nix

@@ -28,6 +28,7 @@
       description = "Network manager applet";
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
+      after = [ "graphical-session.target" ];
       serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet ${lib.optionalString config.programs.nm-applet.indicator "--indicator"}";
     };
 

nixos/modules/services/accessibility/speechd.nix

@@ -7,7 +7,6 @@
 let
   cfg = config.services.speechd;
   inherit (lib)
-    getExe
     mkEnableOption
     mkIf
     mkPackageOption
@@ -21,12 +20,12 @@ in
     package = mkPackageOption pkgs "speechd" { };
   };
 
-  # FIXME: speechd 0.12 (or whatever the next version is)
-  # will support socket activation, so switch to that once it's out.
   config = mkIf cfg.enable {
     environment = {
       systemPackages = [ cfg.package ];
-      sessionVariables.SPEECHD_CMD = getExe cfg.package;
     };
+    systemd.packages = [ cfg.package ];
+    # have to set `wantedBy` since `systemd.packages` ignores `[Install]`
+    systemd.user.sockets.speech-dispatcher.wantedBy = [ "sockets.target" ];
   };
 }

nixos/modules/services/admin/oxidized.nix

@@ -11,6 +11,8 @@ in
   options.services.oxidized = {
     enable = lib.mkEnableOption "the oxidized configuration backup service";
 
+    package = lib.mkPackageOption pkgs "oxidized" { };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "oxidized";
@@ -70,7 +72,8 @@ in
     };
 
     routerDB = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       example = lib.literalExpression ''
         pkgs.writeText "oxidized-router.db" '''
           hostname-sw1:powerconnect:username1:password2
@@ -94,18 +97,57 @@ in
       isSystemUser = true;
     };
 
+    systemd.tmpfiles.settings."10-oxidized" =
+      {
+        "${cfg.dataDir}" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config/oxidized" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config/oxidized/config" = {
+          L = {
+            argument = "${cfg.configFile}";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+      }
+      // lib.optionalAttrs (cfg.routerDB != null) {
+        "${cfg.dataDir}/.config/oxidized/router.db" = {
+          L = {
+            argument = "${cfg.routerDB}";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+      };
+
     systemd.services.oxidized = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
-      preStart = ''
-        mkdir -p ${cfg.dataDir}/.config/oxidized
-        ln -f -s ${cfg.routerDB} ${cfg.dataDir}/.config/oxidized/router.db
-        ln -f -s ${cfg.configFile} ${cfg.dataDir}/.config/oxidized/config
-      '';
-
       serviceConfig = {
-        ExecStart = "${pkgs.oxidized}/bin/oxidized";
+        ExecStart = lib.getExe cfg.package;
         User = cfg.user;
         Group = cfg.group;
         UMask = "0077";

nixos/modules/services/audio/music-assistant.nix

@@ -69,6 +69,9 @@ in
       description = "Music Assistant";
       documentation = [ "https://music-assistant.io" ];
 
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
       wantedBy = [ "multi-user.target" ];
 
       environment = {

nixos/modules/services/hardware/hddfancontrol.nix

@@ -18,64 +18,162 @@ in
       "hddfancontrol"
       "smartctl"
     ] "Smartctl is now automatically used when necessary, which makes this option redundant")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "disks"
+    ] "Disks should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "pwmPaths"
+    ] "Pwm Paths should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "logVerbosity"
+    ] "Log Verbosity should now be specified per hddfancontrol instance in its attrset")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hddfancontrol"
+      "extraArgs"
+    ] "Extra Args should now be specified per hddfancontrol instance in its attrset")
   ];
 
   options = {
     services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";
 
-    services.hddfancontrol.disks = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Drive(s) to get temperature from
-      '';
-      example = [ "/dev/sda" ];
-    };
+    services.hddfancontrol.settings = lib.mkOption {
+      type = lib.types.attrsWith {
+        placeholder = "drive-bay-name";
+        elemType = (
+          lib.types.submodule (
+            { ... }:
+            {
+              options = {
+                disks = lib.mkOption {
+                  type = lib.types.listOf lib.types.path;
+                  default = [ ];
+                  description = ''
+                    Drive(s) to get temperature from
+                  '';
+                  example = [ "/dev/sda" ];
+                };
 
-    services.hddfancontrol.pwmPaths = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
-      '';
-      example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
-    };
+                pwmPaths = lib.mkOption {
+                  type = lib.types.listOf lib.types.path;
+                  default = [ ];
+                  description = ''
+                    PWM filepath(s) to control fan speed (under /sys), followed by initial and fan-stop PWM values
+                  '';
+                  example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];
+                };
 
-    services.hddfancontrol.logVerbosity = lib.mkOption {
-      type = lib.types.enum [
-        "TRACE"
-        "DEBUG"
-        "INFO"
-        "WARN"
-        "ERROR"
-      ];
-      default = "INFO";
-      description = ''
-        Verbosity of the log level
-      '';
-    };
+                logVerbosity = lib.mkOption {
+                  type = lib.types.enum [
+                    "TRACE"
+                    "DEBUG"
+                    "INFO"
+                    "WARN"
+                    "ERROR"
+                  ];
+                  default = "INFO";
+                  description = ''
+                    Verbosity of the log level
+                  '';
+                };
 
-    services.hddfancontrol.extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
+                extraArgs = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Extra commandline arguments for hddfancontrol
+                  '';
+                  example = [
+                    "--min-fan-speed-prct=10"
+                    "--interval=1min"
+                  ];
+                };
+              };
+            }
+          )
+        );
+      };
+      default = { };
       description = ''
-        Extra commandline arguments for hddfancontrol
+        Parameter-sets for each instance of hddfancontrol.
+      '';
+      example = lib.literalExpression ''
+        {
+          harddrives = {
+            disks = [
+              "/dev/sda"
+              "/dev/sdb"
+              "/dev/sdc"
+            ];
+            pwmPaths = [
+              "/sys/class/hwmon/hwmon1/pwm1:25:10"
+            ];
+            logVerbosity = "DEBUG";
+          };
+          ssddrives = {
+            disks = [
+              "/dev/sdd"
+              "/dev/sde"
+              "/dev/sdf"
+            ];
+            pwmPaths = [
+              "/sys/class/hwmon/hwmon1/pwm2:25:10"
+            ];
+            extraArgs = [
+              "--interval=30s"
+            ];
+          };
+        }
       '';
-      example = [
-        "--min-fan-speed-prct=10"
-        "--interval=1min"
-      ];
     };
   };
 
   config = lib.mkIf cfg.enable (
     let
-      args = lib.concatLists [
-        [ "-d" ]
-        cfg.disks
-        [ "-p" ]
-        cfg.pwmPaths
-        cfg.extraArgs
+      args =
+        cnf:
+        lib.concatLists [
+          [ "-d" ]
+          cnf.disks
+          [ "-p" ]
+          cnf.pwmPaths
+          cnf.extraArgs
+        ];
+
+      createService = cnf: {
+        description = "HDD fan control";
+        documentation = [ "man:hddfancontrol(1)" ];
+        after = [ "hddtemp.service" ];
+        wants = [ "hddtemp.service" ];
+        serviceConfig = {
+          ExecStart = "${lib.getExe pkgs.hddfancontrol} -v ${cnf.logVerbosity} daemon ${lib.escapeShellArgs (args cnf)}";
+
+          CPUSchedulingPolicy = "rr";
+          CPUSchedulingPriority = 49;
+
+          ProtectSystem = "strict";
+          PrivateTmp = true;
+          ProtectHome = true;
+          SystemCallArchitectures = "native";
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      services = lib.attrsets.mergeAttrsList [
+        (lib.attrsets.mapAttrs' (
+          name: cnf: lib.nameValuePair "hddfancontrol-${name}" (createService cnf)
+        ) cfg.settings)
+        {
+          "hddfancontrol".enable = false;
+        }
       ];
     in
     {
@@ -83,16 +181,10 @@ in
 
       hardware.sensor.hddtemp = {
         enable = true;
-        drives = cfg.disks;
+        drives = lib.lists.flatten (lib.attrsets.catAttrs "disks" (lib.attrsets.attrValues cfg.settings));
       };
 
-      systemd.services.hddfancontrol = {
-        wantedBy = [ "multi-user.target" ];
-        environment = {
-          HDDFANCONTROL_LOG_LEVEL = cfg.logVerbosity;
-          HDDFANCONTROL_DAEMON_ARGS = lib.escapeShellArgs args;
-        };
-      };
+      systemd.services = services;
     }
   );
 }

nixos/modules/services/monitoring/librenms.nix

@@ -596,7 +596,9 @@ in
           ${pkgs.envsubst}/bin/envsubst -i ${configJson} -o ${cfg.dataDir}/config.json
           export PHPRC=${phpIni}
 
+          INIT=false
           if [[ ! -s ${cfg.dataDir}/.env ]]; then
+            INIT=true
             # init .env file
             echo "APP_KEY=" > ${cfg.dataDir}/.env
             ${artisanWrapper}/bin/librenms-artisan key:generate --ansi
@@ -655,6 +657,10 @@ in
             echo "${package.version}" > ${cfg.dataDir}/version
           fi
 
+          if [[ $INIT == "true" ]]; then
+            ${artisanWrapper}/bin/librenms-artisan db:seed --force --no-interaction
+          fi
+
           # regenerate cache if package has changed
           if [[ $OLD_PACKAGE != "${package}" ]]; then
             ${artisanWrapper}/bin/librenms-artisan view:clear

nixos/modules/services/networking/cato-client.nix

@@ -0,0 +1,75 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkIf mkEnableOption mkPackageOption;
+
+  cfg = config.services.cato-client;
+in
+{
+  options.services.cato-client = {
+    enable = mkEnableOption "cato-client service";
+    package = mkPackageOption pkgs "cato-client" { };
+  };
+
+  config = mkIf cfg.enable {
+    users = {
+      groups.cato-client = { };
+    };
+
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    systemd.services.cato-client = {
+      enable = true;
+      description = "Cato Networks Linux client - connects tunnel to Cato cloud";
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "root"; # Note: daemon runs as root, tools sticky to group
+        Group = "cato-client";
+        ExecStart = "${cfg.package}/bin/cato-clientd systemd";
+        WorkingDirectory = "${cfg.package}";
+        Restart = "always";
+
+        # Cato client seems to do the following:
+        # - Look in each user's ~/.cato/ for configuration and keys
+        # - Write to /var/log/cato-client.log
+        # - Create and use sockets /var/run/cato-sdp.i, /var/run/cato-sdp.o
+        # - Read and Write to /opt/cato/ for runtime settings
+        # - Read /etc/systemd/resolved.conf (but fine if fails)
+        # - Restart systemd-resolved (also fine if doesn't exist)
+
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectSystem = true;
+      };
+
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # set up Security wrapper Same as inteded in deb post install
+    security.wrappers.cato-clientd = {
+      source = "${cfg.package}/bin/cato-clientd";
+      owner = "root";
+      group = "cato-client";
+      permissions = "u+rwx,g+rwx"; # 770
+      setgid = true;
+    };
+
+    security.wrappers.cato-sdp = {
+      source = "${cfg.package}/bin/cato-sdp";
+      owner = "root";
+      group = "cato-client";
+      permissions = "u+rwx,g+rx,a+rx"; # 755
+      setgid = true;
+    };
+  };
+}

nixos/modules/services/networking/cloudflared.nix

@@ -369,7 +369,7 @@ in
           RuntimeDirectoryMode = "0400";
           LoadCredential = [
             "credentials.json:${tunnel.credentialsFile}"
-          ] ++ (lib.optional (certFile != null) "cert.pem:certFile");
+          ] ++ (lib.optional (certFile != null) "cert.pem:${certFile}");
 
           ExecStart = "${cfg.package}/bin/cloudflared tunnel --config=${mkConfigFile} --no-autoupdate run";
           Restart = "on-failure";

nixos/modules/services/networking/headscale.nix

@@ -164,7 +164,7 @@ in
                 '';
               };
 
-              auto_update_enable = lib.mkOption {
+              auto_update_enabled = lib.mkOption {
                 type = lib.types.bool;
                 default = true;
                 description = ''
@@ -493,7 +493,11 @@ in
   imports = with lib; [
     (mkRenamedOptionModule
       [ "services" "headscale" "derp" "autoUpdate" ]
-      [ "services" "headscale" "settings" "derp" "auto_update_enable" ]
+      [ "services" "headscale" "settings" "derp" "auto_update_enabled" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "headscale" "derp" "auto_update_enable" ]
+      [ "services" "headscale" "settings" "derp" "auto_update_enabled" ]
     )
     (mkRenamedOptionModule
       [ "services" "headscale" "derp" "paths" ]

nixos/modules/services/networking/syncthing.nix

@@ -55,10 +55,19 @@ let
           were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
         ''
         {
-          devices = map (
-            device:
-            if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device
-          ) folder.devices;
+          devices =
+            let
+              folderDevices = folder.devices;
+            in
+            map (
+              device:
+              if builtins.isString device then
+                { deviceId = cfg.settings.devices.${device}.id; }
+              else if builtins.isAttrs device then
+                { deviceId = cfg.settings.devices.${device.name}.id; } // device
+              else
+                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
+            ) folderDevices;
         }
   ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
 
@@ -128,9 +137,79 @@ let
               # don't exist in the array given. That's why we use here `POST`, and
               # only if s.override == true then we DELETE the relevant folders
               # afterwards.
-              (map (new_cfg: ''
-                curl -d ${lib.escapeShellArg (builtins.toJSON new_cfg)} -X POST ${s.baseAddress}
-              ''))
+              (map (
+                new_cfg:
+                let
+                  jsonPreSecretsFile = pkgs.writeTextFile {
+                    name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";
+                    text = builtins.toJSON new_cfg;
+                  };
+                  injectSecretsJqCmd =
+                    {
+                      # There are no secrets in `devs`, so no massaging needed.
+                      "devs" = "${jq} .";
+                      "dirs" =
+                        let
+                          folder = new_cfg;
+                          devicesWithSecrets = lib.pipe folder.devices [
+                            (lib.filter (device: (builtins.isAttrs device) && device ? encryptionPasswordFile))
+                            (map (device: {
+                              deviceId = device.deviceId;
+                              variableName = "secret_${builtins.hashString "sha256" device.encryptionPasswordFile}";
+                              secretPath = device.encryptionPasswordFile;
+                            }))
+                          ];
+                          # At this point, `jsonPreSecretsFile` looks something like this:
+                          #
+                          #   {
+                          #     ...,
+                          #     "devices": [
+                          #       {
+                          #         "deviceId": "id1",
+                          #         "encryptionPasswordFile": "/etc/bar-encryption-password",
+                          #         "name": "..."
+                          #       }
+                          #     ],
+                          #   }
+                          #
+                          # We now generate a `jq` command that can replace those
+                          # `encryptionPasswordFile`s with `encryptionPassword`.
+                          # The `jq` command ends up looking like this:
+                          #
+                          #   jq --rawfile secret_DEADBEEF /etc/bar-encryption-password '
+                          #     .devices[] |= (
+                          #       if .deviceId == "id1" then
+                          #         del(.encryptionPasswordFile) |
+                          #         .encryptionPassword = $secret_DEADBEEF
+                          #       else
+                          #         .
+                          #       end
+                          #     )
+                          #   '
+                          jqUpdates = map (device: ''
+                            .devices[] |= (
+                              if .deviceId == "${device.deviceId}" then
+                                del(.encryptionPasswordFile) |
+                                .encryptionPassword = ''$${device.variableName}
+                              else
+                                .
+                              end
+                            )
+                          '') devicesWithSecrets;
+                          jqRawFiles = map (
+                            device: "--rawfile ${device.variableName} ${lib.escapeShellArg device.secretPath}"
+                          ) devicesWithSecrets;
+                        in
+                        "${jq} ${lib.concatStringsSep " " jqRawFiles} ${
+                          lib.escapeShellArg (lib.concatStringsSep "|" ([ "." ] ++ jqUpdates))
+                        }";
+                    }
+                    .${conf_type};
+                in
+                ''
+                  ${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}
+                ''
+              ))
               (lib.concatStringsSep "\n")
             ]
             /*
@@ -438,11 +517,48 @@ in
                       };
 
                       devices = mkOption {
-                        type = types.listOf types.str;
+                        type = types.listOf (
+                          types.oneOf [
+                            types.str
+                            (types.submodule (
+                              { ... }:
+                              {
+                                freeformType = settingsFormat.type;
+                                options = {
+                                  name = mkOption {
+                                    type = types.str;
+                                    default = null;
+                                    description = ''
+                                      The name of a device defined in the
+                                      [devices](#opt-services.syncthing.settings.devices)
+                                      option.
+                                    '';
+                                  };
+                                  encryptionPasswordFile = mkOption {
+                                    type = types.nullOr (
+                                      types.pathWith {
+                                        inStore = false;
+                                        absolute = true;
+                                      }
+                                    );
+                                    default = null;
+                                    description = ''
+                                      Path to encryption password. If set, the file will be read during
+                                      service activation, without being embedded in derivation.
+                                    '';
+                                  };
+                                };
+                              }
+                            ))
+                          ]
+                        );
                         default = [ ];
                         description = ''
                           The devices this folder should be shared with. Each device must
                           be defined in the [devices](#opt-services.syncthing.settings.devices) option.
+
+                          A list of either strings or attribute sets, where values
+                          are device names or device configurations.
                         '';
                       };
 

nixos/modules/services/video/frigate.nix

@@ -669,7 +669,11 @@ in
 
         # Caches
         PrivateTmp = true;
-        CacheDirectory = "frigate";
+        CacheDirectory = [
+          "frigate"
+          # https://github.com/blakeblackshear/frigate/discussions/18129
+          "frigate/model_cache"
+        ];
         CacheDirectoryMode = "0750";
 
         # Sockets/IPC

nixos/modules/services/web-apps/gancio.nix

@@ -174,7 +174,7 @@ in
         if [[ "$USER" != ${cfg.user} ]]; then
           sudo="exec /run/wrappers/bin/sudo -u ${cfg.user}"
         fi
-        $sudo ${lib.getExe cfg.package} ''${1:--help}
+        $sudo ${lib.getExe cfg.package} "''${@:--help}"
         ' > $out/bin/gancio
         chmod +x $out/bin/gancio
       '')

nixos/modules/services/web-apps/kimai.nix

@@ -324,12 +324,14 @@ in
                 ${pkg hostName cfg}/bin/console lint:yaml --parse-tags \
                   ${pkg hostName cfg}/share/php/kimai/config
 
-                # Run kimai:install to ensure database is created or updated.
+                # Before running any further console commands, clear cache. This
+                # avoids errors due to old cache getting used with new version
+                # of Kimai.
+                ${pkg hostName cfg}/bin/console cache:clear --env=prod
+                # Then, run kimai:install to ensure database is created or updated.
                 # Note that kimai:update is an alias to kimai:install.
                 ${pkg hostName cfg}/bin/console kimai:install --no-cache
-                # Clear cache and warmup cache separately, to avoid "Cannot declare
-                # class App\Entity\Timesheet" error on first init after upgrade.
-                ${pkg hostName cfg}/bin/console cache:clear --env=prod
+                # Finally, warm up cache.
                 ${pkg hostName cfg}/bin/console cache:warmup --env=prod
               '';
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -9,6 +9,11 @@ with lib;
 
 let
   cfg = config.services.nextcloud;
+
+  overridePackage = cfg.package.override {
+    inherit (config.security.pki) caBundle;
+  };
+
   fpm = config.services.phpfpm.pools.nextcloud;
 
   jsonFormat = pkgs.formats.json { };
@@ -51,13 +56,13 @@ let
   };
 
   webroot =
-    pkgs.runCommand "${cfg.package.name or "nextcloud"}-with-apps"
+    pkgs.runCommand "${overridePackage.name or "nextcloud"}-with-apps"
       {
         preferLocalBuild = true;
       }
       ''
         mkdir $out
-        ln -sfv "${cfg.package}"/* "$out"
+        ln -sfv "${overridePackage}"/* "$out"
         ${concatStrings (
           mapAttrsToList (
             name: store:
@@ -116,7 +121,8 @@ let
     ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
     ++ (lib.optional (
       cfg.config.objectstore.s3.sseCKeyFile != null
-    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
+    ) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}")
+    ++ (lib.optional (cfg.secretFile != null) "secret_file:${cfg.secretFile}");
 
   requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
 
@@ -184,8 +190,8 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.config.dbtype == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.config.dbtype == "pgsql";
 
-  nextcloudGreaterOrEqualThan = versionAtLeast cfg.package.version;
-  nextcloudOlderThan = versionOlder cfg.package.version;
+  nextcloudGreaterOrEqualThan = versionAtLeast overridePackage.version;
+  nextcloudOlderThan = versionOlder overridePackage.version;
 
   # https://github.com/nextcloud/documentation/pull/11179
   ocmProviderIsNotAStaticDirAnymore =
@@ -195,7 +201,6 @@ let
   overrideConfig =
     let
       c = cfg.config;
-      requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
       objectstoreConfig =
         let
           s3 = c.objectstore.s3;
@@ -232,7 +237,7 @@ let
     in
     pkgs.writeText "nextcloud-config.php" ''
       <?php
-      ${optionalString requiresReadSecretFunction ''
+      ${optionalString requiresRuntimeSystemdCredentials ''
         function nix_read_secret($credential_name) {
           $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
           if (!$credentials_directory) {
@@ -253,7 +258,19 @@ let
           }
 
           return trim(file_get_contents($credential_path));
-        }''}
+        }
+
+        function nix_read_secret_and_decode_json_file($credential_name) {
+          $decoded = json_decode(nix_read_secret($credential_name), true);
+
+          if (json_last_error() !== JSON_ERROR_NONE) {
+            error_log(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
+            exit(1);
+          }
+
+          return $decoded;
+        }
+      ''}
       function nix_decode_json_file($file, $error) {
         if (!file_exists($file)) {
           throw new \RuntimeException(sprintf($error, $file));
@@ -287,10 +304,7 @@ let
       ));
 
       ${optionalString (cfg.secretFile != null) ''
-        $CONFIG = array_replace_recursive($CONFIG, nix_decode_json_file(
-          "${cfg.secretFile}",
-          "Cannot start Nextcloud, secrets file %s set by NixOS doesn't exist!"
-        ));
+        $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
       ''}
     '';
 in
@@ -1019,12 +1033,12 @@ in
           If you have an existing installation with a custom table prefix, make sure it is
           set correctly in `config.php` and remove the option from your NixOS config.
         '')
-        ++ (optional (versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
-        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
-        ++ (optional (versionOlder cfg.package.version "28") (upgradeWarning 27 "24.05"))
-        ++ (optional (versionOlder cfg.package.version "29") (upgradeWarning 28 "24.11"))
-        ++ (optional (versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
-        ++ (optional (versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"));
+        ++ (optional (versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
+        ++ (optional (versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
+        ++ (optional (versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
+        ++ (optional (versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
+        ++ (optional (versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
+        ++ (optional (versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));
 
       services.nextcloud.package =
         with pkgs;
@@ -1377,6 +1391,8 @@ in
             datadirectory = lib.mkDefault "${datadir}/data";
             trusted_domains = [ cfg.hostName ];
             "upgrade.disable-web" = true;
+            # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
+            "integrity.check.disabled" = true;
           })
           (lib.mkIf cfg.configureRedis {
             "memcache.distributed" = ''\OC\Memcache\Redis'';

nixos/modules/services/web-apps/oncall.nix

@@ -0,0 +1,203 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  cfg = config.services.oncall;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "oncall_extra_settings.yaml" cfg.settings;
+
+in
+{
+  options.services.oncall = {
+
+    enable = lib.mkEnableOption "Oncall web app";
+
+    package = lib.mkPackageOption pkgs "oncall" { };
+
+    database.createLocally = lib.mkEnableOption "Create the database and database user locally." // {
+      default = true;
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          oncall_host = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = "FQDN for the Oncall instance.";
+          };
+          db.conn = {
+            kwargs = {
+              user = lib.mkOption {
+                type = lib.types.str;
+                default = "oncall";
+                description = "Database user.";
+              };
+              host = lib.mkOption {
+                type = lib.types.str;
+                default = "localhost";
+                description = "Database host.";
+              };
+              database = lib.mkOption {
+                type = lib.types.str;
+                default = "oncall";
+                description = "Database name.";
+              };
+            };
+            str = lib.mkOption {
+              type = lib.types.str;
+              default = "%(scheme)s://%(user)s@%(host)s:%(port)s/%(database)s?charset=%(charset)s&unix_socket=/run/mysqld/mysqld.sock";
+              description = ''
+                Database connection scheme. The default specifies the
+                connection through a local socket.
+              '';
+            };
+            require_auth = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether authentication is required to access the web app.
+              '';
+            };
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Extra configuration options to append or override.
+        For available and default option values see
+        [upstream configuration file](https://github.com/linkedin/oncall/blob/master/configs/config.yaml)
+        and the administration part in the
+        [offical documentation](https://oncall.tools/docs/admin_guide.html).
+      '';
+    };
+
+    secretFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      example = "/run/keys/oncall-dbpassword";
+      description = ''
+        A YAML file containing secrets such as database or user passwords.
+        Some variables that can be considered secrets are:
+
+        - db.conn.kwargs.password:
+          Password used to authenticate to the database.
+
+        - session.encrypt_key:
+          Key for encrypting/signing session cookies.
+          Change to random long values in production.
+
+        - session.sign_key:
+          Key for encrypting/signing session cookies.
+          Change to random long values in production.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # Disable debug, only needed for development
+    services.oncall.settings = lib.mkMerge [
+      ({
+        debug = lib.mkDefault false;
+        auth.debug = lib.mkDefault false;
+      })
+    ];
+
+    services.uwsgi = {
+      enable = true;
+      plugins = [ "python3" ];
+      user = "oncall";
+      instance = {
+        type = "emperor";
+        vassals = {
+          oncall = {
+            type = "normal";
+            env = [
+              "PYTHONPATH=${pkgs.oncall.pythonPath}"
+              (
+                "ONCALL_EXTRA_CONFIG="
+                + (lib.concatStringsSep "," (
+                  [ configFile ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile
+                ))
+              )
+              "STATIC_ROOT=/var/lib/oncall"
+            ];
+            module = "oncall.app:get_wsgi_app()";
+            socket = "${config.services.uwsgi.runDir}/oncall.sock";
+            socketGroup = "nginx";
+            immediate-gid = "nginx";
+            chmod-socket = "770";
+            pyargv = "${pkgs.oncall}/share/configs/config.yaml";
+            buffer-size = 32768;
+          };
+        };
+      };
+    };
+
+    services.nginx = {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.settings.oncall_host}".locations = {
+        "/".extraConfig = "uwsgi_pass unix://${config.services.uwsgi.runDir}/oncall.sock;";
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.settings.db.conn.kwargs.database ];
+      ensureUsers = [
+        {
+          name = cfg.settings.db.conn.kwargs.user;
+          ensurePermissions = {
+            "${cfg.settings.db.conn.kwargs.database}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    users.users.oncall = {
+      group = "nginx";
+      isSystemUser = true;
+    };
+
+    systemd = {
+      services = {
+        uwsgi.serviceConfig.StateDirectory = "oncall";
+        oncall-setup-database = lib.mkIf cfg.database.createLocally {
+          description = "Set up Oncall database";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          requiredBy = [ "uwsgi.service" ];
+          after = [ "mysql.service" ];
+          script =
+            let
+              mysql = "${lib.getExe' config.services.mysql.package "mysql"}";
+            in
+            ''
+              if [ ! -f /var/lib/oncall/.dbexists ]; then
+                # Load database schema provided with package
+                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema.v0.sql
+                ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema-update.v0-1602184489.sql
+                touch /var/lib/oncall/.dbexists
+              fi
+            '';
+        };
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}

nixos/modules/services/web-apps/readeck.nix

@@ -68,7 +68,6 @@ in
         ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";
         ProtectSystem = "full";
         SystemCallArchitectures = "native";
-        MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateTmp = true;
         PrivateDevices = true;
@@ -89,7 +88,6 @@ in
         ProtectKernelTunables = true;
         LockPersonality = true;
         Restart = "on-failure";
-
       };
     };
   };

nixos/modules/services/x11/desktop-managers/gnome.md

@@ -19,7 +19,7 @@ To enable the GNOME desktop use:
 While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock [might not work](#sec-gnome-faq-can-i-use-lightdm-with-gnome) without it.
 :::
 
-The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst).
+The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/48.0/elements/core/meta-gnome-core-apps.bst).
 
 ### GNOME without the apps {#sec-gnome-without-the-apps}
 
@@ -27,7 +27,7 @@ If you’d like to only use the GNOME desktop and not the apps, you can disable
 
 ```nix
 {
-  services.gnome.core-utilities.enable = false;
+  services.gnome.core-apps.enable = false;
 }
 ```
 

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -84,12 +84,19 @@ in
     maintainers = lib.teams.gnome.members;
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "gnome" "core-utilities" "enable" ]
+      [ "services" "gnome" "core-apps" "enable" ]
+    )
+  ];
+
   options = {
 
     services.gnome = {
       core-os-services.enable = mkEnableOption "essential services for GNOME3";
       core-shell.enable = mkEnableOption "GNOME Shell services";
-      core-utilities.enable = mkEnableOption "GNOME core utilities";
+      core-apps.enable = mkEnableOption "GNOME core apps";
       core-developer-tools.enable = mkEnableOption "GNOME core developer tools";
       games.enable = mkEnableOption "GNOME games";
     };
@@ -213,7 +220,7 @@ in
 
       services.gnome.core-os-services.enable = true;
       services.gnome.core-shell.enable = true;
-      services.gnome.core-utilities.enable = mkDefault true;
+      services.gnome.core-apps.enable = mkDefault true;
 
       services.displayManager.sessionPackages = [ pkgs.gnome-session.sessions ];
 
@@ -326,17 +333,9 @@ in
     })
 
     (lib.mkIf serviceCfg.core-shell.enable {
-      services.xserver.desktopManager.gnome.sessionPath =
-        let
-          mandatoryPackages = [
-            pkgs.gnome-shell
-          ];
-          optionalPackages = [
-            pkgs.gnome-shell-extensions
-          ];
-        in
-        mandatoryPackages
-        ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
+      services.xserver.desktopManager.gnome.sessionPath = [
+        pkgs.gnome-shell
+      ];
 
       services.colord.enable = mkDefault true;
       services.gnome.glib-networking.enable = true;
@@ -380,14 +379,11 @@ in
 
       services.orca.enable = notExcluded pkgs.orca;
 
-      fonts.packages = with pkgs; [
-        cantarell-fonts
-        dejavu_fonts
-        source-code-pro # Default monospace font in 3.32
-        source-sans
-      ];
+      fonts.packages = utils.removePackagesByName [
+        pkgs.adwaita-fonts
+      ] config.environment.gnome.excludePackages;
 
-      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-38/elements/core/meta-gnome-core-shell.bst
+      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-48/elements/core/meta-gnome-core-shell.bst
       environment.systemPackages =
         let
           mandatoryPackages = [
@@ -400,7 +396,6 @@ in
             pkgs.gnome-bluetooth
             pkgs.gnome-color-manager
             pkgs.gnome-control-center
-            pkgs.gnome-shell-extensions
             pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
             pkgs.gnome-user-docs
             pkgs.glib # for gsettings program
@@ -414,11 +409,12 @@ in
         ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-45/elements/core/meta-gnome-core-utilities.bst
-    (lib.mkIf serviceCfg.core-utilities.enable {
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
+    (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = utils.removePackagesByName (
         [
           pkgs.baobab
+          pkgs.decibels
           pkgs.epiphany
           pkgs.gnome-text-editor
           pkgs.gnome-calculator
@@ -500,17 +496,19 @@ in
       ] config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/3.38.0/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = utils.removePackagesByName [
         pkgs.dconf-editor
         pkgs.devhelp
+        pkgs.d-spy
         pkgs.gnome-builder
         # boxes would make sense in this option, however
         # it doesn't function well enough to be included
         # in default configurations.
         # https://github.com/NixOS/nixpkgs/issues/60908
         # pkgs.gnome-boxes
+        pkgs.sysprof
       ] config.environment.gnome.excludePackages;
 
       services.sysprof.enable = notExcluded pkgs.sysprof;

nixos/modules/services/x11/display-managers/gdm.nix

@@ -211,7 +211,10 @@ in
       pkgs.gnome-session
       pkgs.gnome-shell
     ];
-    environment.systemPackages = [ pkgs.adwaita-icon-theme ];
+    environment.systemPackages = [
+      pkgs.adwaita-icon-theme
+      pkgs.gdm # For polkit rules
+    ];
 
     # We dont use the upstream gdm service
     # it has to be disabled since the gdm package has it

nixos/modules/system/activation/lib/test.sh

@@ -26,6 +26,7 @@ onerr() {
 }
 trap onerr ERR
 
+# shellcheck source-path=SCRIPTDIR
 source ./lib.sh
 
 (warn hi, this works >/dev/null) 2>&1 | grep -E $'.*warning:.* hi, this works' >/dev/null

nixos/modules/system/activation/top-level.nix

@@ -77,14 +77,7 @@ let
   );
 
   # Handle assertions and warnings
-
-  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);
-
-  baseSystemAssertWarn =
-    if failedAssertions != [ ] then
-      throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
-    else
-      showWarnings config.warnings baseSystem;
+  baseSystemAssertWarn = lib.asserts.checkAssertWarn config.assertions config.warnings baseSystem;
 
   # Replace runtime dependencies
   system =

nixos/modules/system/boot/systemd/initrd.nix

@@ -132,13 +132,20 @@ let
   initialRamdisk = pkgs.makeInitrdNG {
     name = "initrd-${kernel-name}";
     inherit (config.boot.initrd) compressor compressorArgs prepend;
-    inherit (cfg) strip;
 
     contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
   };
 
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "boot" "initrd" "systemd" "strip" ] ''
+      The option to strip ELF files in initrd has been removed.
+      It only saved ~1MiB of initramfs size, but caused a few issues
+      like unloadable kernel modules.
+    '')
+  ];
+
   options.boot.initrd.systemd = {
     enable = mkEnableOption "systemd in initrd" // {
       description = ''
@@ -208,19 +215,6 @@ in
       default = [ ];
     };
 
-    strip = mkOption {
-      description = ''
-        Whether to completely strip executables and libraries copied to the initramfs.
-
-        Setting this to false may save on the order of 30MiB on the
-        machine building the system (by avoiding a binutils
-        reference), at the cost of ~1MiB of initramfs size. This puts
-        this option firmly in the territory of micro-optimisation.
-      '';
-      type = types.bool;
-      default = true;
-    };
-
     extraBin = mkOption {
       description = ''
         Tools to add to /bin

nixos/tests/all-tests.nix

@@ -373,7 +373,6 @@ in
   croc = handleTest ./croc.nix { };
   cross-seed = runTest ./cross-seed.nix;
   cyrus-imap = runTest ./cyrus-imap.nix;
-  darling = handleTest ./darling.nix { };
   darling-dmg = runTest ./darling-dmg.nix;
   dae = handleTest ./dae.nix { };
   davis = runTest ./davis.nix;
@@ -619,6 +618,7 @@ in
   odoo = handleTest ./odoo.nix { };
   odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
   odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
+  oncall = runTest ./web-apps/oncall.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.
@@ -1273,6 +1273,7 @@ in
   syncthing-no-settings = handleTest ./syncthing-no-settings.nix { };
   syncthing-init = handleTest ./syncthing-init.nix { };
   syncthing-many-devices = handleTest ./syncthing-many-devices.nix { };
+  syncthing-folders = runTest ./syncthing-folders.nix;
   syncthing-relay = handleTest ./syncthing-relay.nix { };
   sysinit-reactivation = runTest ./sysinit-reactivation.nix;
   systemd = handleTest ./systemd.nix { };
@@ -1424,10 +1425,6 @@ in
     imports = [ ./varnish.nix ];
     _module.args.package = pkgs.varnish60;
   };
-  varnish76 = runTest {
-    imports = [ ./varnish.nix ];
-    _module.args.package = pkgs.varnish76;
-  };
   varnish77 = runTest {
     imports = [ ./varnish.nix ];
     _module.args.package = pkgs.varnish77;

nixos/tests/darling.nix

@@ -1,52 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-
-  let
-    # Well, we _can_ cross-compile from Linux :)
-    hello =
-      pkgs.runCommand "hello"
-        {
-          sdk = "${pkgs.darling.sdk}/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
-          nativeBuildInputs = with pkgs.llvmPackages_14; [
-            clang-unwrapped
-            lld
-          ];
-          src = pkgs.writeText "hello.c" ''
-            #include <stdio.h>
-            int main() {
-              printf("Hello, Darling!\n");
-              return 0;
-            }
-          '';
-        }
-        ''
-          clang \
-            -target x86_64-apple-darwin \
-            -fuse-ld=lld \
-            -nostdinc -nostdlib \
-            -mmacosx-version-min=10.15 \
-            --sysroot $sdk \
-            -isystem $sdk/usr/include \
-            -L $sdk/usr/lib -lSystem \
-            $src -o $out
-        '';
-  in
-  {
-    name = "darling";
-
-    meta.maintainers = with lib.maintainers; [ zhaofengli ];
-
-    nodes.machine = {
-      programs.darling.enable = true;
-    };
-
-    testScript = ''
-      start_all()
-
-      # Darling holds stdout until the server is shutdown
-      machine.succeed("darling ${hello} >hello.out")
-      machine.succeed("grep Hello hello.out")
-      machine.succeed("darling shutdown")
-    '';
-  }
-)

nixos/tests/installed-tests/libxmlb.nix

@@ -2,4 +2,10 @@
 
 makeInstalledTest {
   tested = pkgs.libxmlb;
+
+  testConfig = {
+    environment.variables = {
+      G_TEST_SRCDIR = "${pkgs.libxmlb.installedTests}/libexec/installed-tests/libxmlb";
+    };
+  };
 }

nixos/tests/librenms.nix

@@ -50,9 +50,6 @@ in
         API_USER_NAME=api
         API_TOKEN=${api_token} # random md5 hash
 
-        # seeding database to get the admin roles
-        ${pkgs.librenms}/artisan db:seed --force --no-interaction
-
         # we don't need to know the password, it just has to exist
         API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
         ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS

nixos/tests/lomiri-calendar-app.nix

@@ -44,23 +44,33 @@
 
     with subtest("lomiri calendar launches"):
         machine.succeed("lomiri-calendar-app >&2 &")
-        machine.wait_for_text(r"(January|February|March|April|May|June|July|August|September|October|November|December)")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(2)
+        # Default page is unbearably slow to OCR on, switch to another
+        machine.succeed("xdotool mousemove 580 50 click 1")
+        machine.sleep(2)
+        machine.wait_for_text(r"(January|February|March|April|May|June|July|August|September|October|November|December|Mon|Tue|Wed|Thu|Fri|Sat|Sun)")
         machine.screenshot("lomiri-calendar")
 
     with subtest("lomiri calendar works"):
         # Switch to Agenda tab, less busy
-        machine.succeed("xdotool mousemove 300 50 click 1")
+        machine.succeed("xdotool mousemove 380 50 click 1")
+        machine.sleep(2)
 
         # Still on main page
-        machine.succeed("xdotool mousemove 500 650 click 1")
+        machine.succeed("xdotool mousemove 500 720 click 1")
+        machine.sleep(2)
         machine.wait_for_text(r"(Date|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday|All day|Name|Details|More)")
         machine.screenshot("lomiri-calendar_newevent")
 
         # On New Event page
         machine.succeed("xdotool mousemove 500 230 click 1")
+        machine.sleep(2)
         machine.send_chars("foobar")
         machine.sleep(2) # make sure they're actually in there
-        machine.succeed("xdotool mousemove 780 40 click 1")
+        machine.succeed("xdotool mousemove 1000 40 click 1")
+        machine.sleep(2)
         machine.wait_for_text("Agenda")
         machine.screenshot("lomiri-calendar_eventadded")
 
@@ -73,6 +83,9 @@
 
     with subtest("lomiri calendar localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-calendar-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(2)
         machine.wait_for_text(r"(Montag|Dienstag|Mittwoch|Donnerstag|Freitag|Samstag|Sonntag)")
         machine.screenshot("lomiri-calendar_localised")
   '';

nixos/tests/lomiri-camera-app.nix

@@ -47,7 +47,7 @@
 
   testScript =
     let
-      qrLabel = "Image";
+      qrLabel = "Feed";
       qrContent = "Test";
     in
     ''
@@ -55,6 +55,10 @@
 
       with subtest("lomiri camera launches"):
           machine.succeed("lomiri-camera-app >&2 &")
+          machine.wait_for_console_text("updateViewfinderResolution: viewfinder resolutions is not known yet")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("Cannot access")
           machine.screenshot("lomiri-camera_open")
 
@@ -64,21 +68,26 @@
       machine.succeed("modprobe v4l2loopback video_nr=10 card_label=Video-Loopback exclusive_caps=1")
       machine.succeed("qrtool encode '${qrContent}' -s 20 -m 10 > qr.png")
       # Horizontal flip, add text, flip back. Camera displays image mirrored, so need reversed text for OCR
-      machine.succeed("magick qr.png -flop -pointsize 70 -fill black -annotate +100+100 '${qrLabel}' -flop output.png")
+      machine.succeed("magick qr.png -flop -pointsize 30 -fill black -annotate +100+100 '${qrLabel}' -flop output.png")
       machine.succeed("ffmpeg -re -loop 1 -i output.png -vf format=yuv420p -f v4l2 /dev/video10 -loglevel fatal >&2 &")
 
       with subtest("lomiri camera uses camera"):
           machine.succeed("lomiri-camera-app >&2 &")
+          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("${qrLabel}")
           machine.screenshot("lomiri-camera_feed")
 
-          machine.succeed("xdotool mousemove 320 610 click 1") # take photo
-          machine.wait_until_succeeds("find /root/Pictures/camera.ubports -name '*.jpg'")
+          machine.succeed("xdotool mousemove 510 670 click 1") # take photo
+          machine.wait_until_succeeds("ls /root/Pictures/camera.ubports | grep '\\.jpg$'")
 
           # Check that the image is correct
           machine.send_key("ctrl-alt-right")
           machine.succeed("magick /root/Pictures/camera.ubports/IMG_00000001.jpg -flop photo_flip.png")
           machine.succeed("feh photo_flip.png >&2 &")
+          machine.sleep(10)
           machine.wait_for_text("${qrLabel}")
           machine.screenshot("lomiri-camera_photo")
 
@@ -88,18 +97,25 @@
 
       with subtest("lomiri barcode scanner uses camera"):
           machine.succeed("lomiri-camera-app --mode=barcode-reader >&2 &")
+          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("${qrLabel}")
-          machine.succeed("xdotool mousemove 320 610 click 1") # open up QR decode result
+          machine.succeed("xdotool mousemove 510 670 click 1") # open up QR decode result
 
           # OCR is struggling to recognise the text. Click the clipboard button and paste the result somewhere else
           machine.sleep(5)
           machine.screenshot("lomiri-barcode_decode")
-          machine.succeed("xdotool mousemove 350 530 click 1")
+          machine.succeed("xdotool mousemove 540 590 click 1")
           machine.sleep(5)
 
           # Need to make a new window without closing camera app, otherwise clipboard content gets lost?
           machine.send_key("ctrl-alt-right")
           machine.succeed("gnome-text-editor >&2 &")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("New")
 
           # Font size up to help with OCR
@@ -129,6 +145,10 @@
 
       with subtest("lomiri camera localisation works"):
           machine.succeed("env LANG=de_DE.UTF-8 lomiri-camera-app >&2 &")
+          machine.wait_for_console_text("updateViewfinderResolution: For target resolution")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("Kamera")
           machine.screenshot("lomiri-camera_localised")
     '';

nixos/tests/lomiri-clock-app.nix

@@ -34,14 +34,20 @@
     machine.wait_for_x()
 
     with subtest("lomiri clock launches"):
-        machine.execute("lomiri-clock-app >&2 &")
+        machine.succeed("lomiri-clock-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text(r"(clock.ubports|City|Alarms)")
         machine.screenshot("lomiri-clock_open")
 
     machine.succeed("pkill -f lomiri-clock-app")
 
     with subtest("lomiri clock localisation works"):
-        machine.execute("env LANG=de_DE.UTF-8 lomiri-clock-app >&2 &")
+        machine.succeed("env LANG=de_DE.UTF-8 lomiri-clock-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text(r"(Stadt|Weckzeiten)")
         machine.screenshot("lomiri-clock_localised")
   '';

nixos/tests/lomiri-docviewer-app.nix

@@ -46,6 +46,9 @@ in
 
     with subtest("lomiri docviewer launches"):
         machine.succeed("lomiri-docviewer-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text("No documents")
         machine.screenshot("lomiri-docviewer_open")
 
@@ -57,6 +60,9 @@ in
 
     with subtest("lomiri docviewer txt works"):
         machine.succeed("lomiri-docviewer-app /etc/docviewer-sampletext.txt >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text("${exampleText}")
         machine.screenshot("lomiri-docviewer_txt")
 
@@ -64,6 +70,9 @@ in
 
     with subtest("lomiri docviewer odt works"):
         machine.succeed("lomiri-docviewer-app /root/docviewer-sampletext.odt >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text("${exampleText}")
         machine.screenshot("lomiri-docviewer_odt")
 
@@ -71,6 +80,9 @@ in
 
     with subtest("lomiri docviewer pdf works"):
         machine.succeed("lomiri-docviewer-app /root/docviewer-sampletext.pdf >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text("${exampleText}")
         machine.screenshot("lomiri-docviewer_pdf")
 
@@ -78,6 +90,9 @@ in
 
     with subtest("lomiri docviewer localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-docviewer-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(5)
         machine.wait_for_text("Keine Dokumente")
         machine.screenshot("lomiri-docviewer_localised")
   '';

nixos/tests/lomiri-gallery-app.nix

@@ -59,8 +59,15 @@
       machine.succeed("mkdir /root/Pictures /root/Videos")
       # Setup example data, OCR-friendly:
       # - White square, black text
+      # - Small text for display OCR
+      # - Big text for gallery preview OCR
       # - uppercase extension
-      machine.succeed("magick -size 500x500 -background white -fill black canvas:white -pointsize 70 -annotate +100+300 '${imageLabel}' /root/Pictures/output.PNG")
+      machine.succeed(
+          "magick -size 500x500 -background white -fill black canvas:white "
+          + "-pointsize 20 -annotate +100+100 '${imageLabel}' "
+          + "-pointsize 50 -annotate +100+300 '${imageLabel}' "
+          + "/root/Pictures/output.PNG"
+      )
 
       # Different image formats
       machine.succeed("magick /root/Pictures/output.PNG /root/Pictures/output.JPG")

nixos/tests/lomiri-mediaplayer-app.nix

@@ -1,6 +1,6 @@
 { lib, ... }:
 let
-  ocrContent = "Video Test";
+  ocrContent = "Feed";
   videoFile = "test.webm";
 in
 {
@@ -25,8 +25,8 @@ in
               ];
             }
             ''
-              magick -size 400x400 canvas:white -pointsize 40 -fill black -annotate +100+100 '${ocrContent}' output.png
-              ffmpeg -re -loop 1 -i output.png -c:v libvpx -b:v 100K -t 120 $out -loglevel fatal
+              magick -size 600x600 canvas:white -pointsize 20 -fill black -annotate +100+100 '${ocrContent}' output.png
+              ffmpeg -re -loop 1 -i output.png -c:v libvpx -b:v 200K -t 120 $out -loglevel fatal
             '';
         systemPackages = with pkgs.lomiri; [
           suru-icon-theme
@@ -54,6 +54,8 @@ in
 
     with subtest("lomiri mediaplayer launches"):
         machine.succeed("lomiri-mediaplayer-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
         machine.wait_for_text("Choose from")
         machine.screenshot("lomiri-mediaplayer_open")
 
@@ -61,6 +63,8 @@ in
 
     with subtest("lomiri mediaplayer plays video"):
         machine.succeed("lomiri-mediaplayer-app /etc/${videoFile} >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
         machine.wait_for_text("${ocrContent}")
         machine.screenshot("lomiri-mediaplayer_playback")
 
@@ -71,6 +75,8 @@ in
         # Cause an error, and look for the error popup
         machine.succeed("touch invalid.mp4")
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-mediaplayer-app invalid.mp4 >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
         machine.wait_for_text("Fehler")
         machine.screenshot("lomiri-mediaplayer_localised")
   '';

nixos/tests/lomiri-music-app.nix

@@ -140,8 +140,10 @@ in
 
     with subtest("lomiri music launches"):
         machine.succeed("lomiri-music-app >&2 &")
-        machine.wait_for_text("favorite music")
+        machine.sleep(10)
         machine.send_key("alt-f10")
+        machine.sleep(2)
+        machine.wait_for_text("favorite music")
         machine.screenshot("lomiri-music")
 
     with subtest("lomiri music plays music"):
@@ -187,6 +189,9 @@ in
 
     with subtest("lomiri music localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-music-app .mp4 >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
+        machine.sleep(2)
         machine.wait_for_text("Titel")
         machine.screenshot("lomiri-music_localised")
   '';

nixos/tests/lomiri-system-settings.nix

@@ -109,7 +109,11 @@
       machine.wait_for_x()
 
       with subtest("lomiri system settings launches"):
-          machine.execute("lomiri-system-settings >&2 &")
+          machine.succeed("lomiri-system-settings >&2 &")
+          machine.wait_for_console_text("qml: Plugin about does not exist")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("System Settings")
           machine.screenshot("lss_open")
 
@@ -137,7 +141,11 @@
       machine.execute("pkill -f lomiri-system-settings")
 
       with subtest("lomiri system settings localisation works"):
-          machine.execute("env LANG=de_DE.UTF-8 lomiri-system-settings >&2 &")
+          machine.succeed("env LANG=de_DE.UTF-8 lomiri-system-settings >&2 &")
+          machine.wait_for_console_text("qml: Plugin about does not exist")
+          machine.sleep(10)
+          machine.send_key("alt-f10")
+          machine.sleep(5)
           machine.wait_for_text("Systemeinstellungen")
           machine.screenshot("lss_localised_open")
 

nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix

@@ -84,13 +84,12 @@ runTest (
           # This file is meant to contain secret options which should
           # not go into the nix store. Here it is just used to set the
           # redis password.
-          environment.etc."nextcloud-secrets.json".text = ''
-            {
-              "redis": {
-                "password": "secret"
-              }
-            }
-          '';
+          environment.etc."nextcloud-secrets.json" = {
+            mode = "0600";
+            text = builtins.toJSON {
+              redis.password = "secret";
+            };
+          };
         };
     };
 

nixos/tests/nextcloud/with-objectstore.nix

@@ -26,11 +26,13 @@ runTest (
 
     nodes = {
       nextcloud =
-        { config, pkgs, ... }:
         {
-          networking.firewall.allowedTCPPorts = [ 9000 ];
-          environment.systemPackages = [ pkgs.minio-client ];
-
+          config,
+          pkgs,
+          nodes,
+          ...
+        }:
+        {
           services.nextcloud.config.dbtype = "sqlite";
 
           services.nextcloud.config.objectstore.s3 = {
@@ -39,13 +41,66 @@ runTest (
             autocreate = true;
             key = accessKey;
             secretFile = "${pkgs.writeText "secretKey" secretKey}";
-            hostname = "nextcloud";
-            useSsl = false;
-            port = 9000;
+            hostname = "acme.test";
+            useSsl = true;
+            port = 443;
             usePathStyle = true;
             region = "us-east-1";
           };
 
+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+
+          environment.systemPackages = [ pkgs.minio-client ];
+
+          # The dummy certs are for acme.test, so we pretend that's the FQDN
+          # of the minio VM.
+          networking.extraHosts = ''
+            ${nodes.minio.networking.primaryIPAddress} acme.test
+          '';
+        };
+
+      client =
+        { nodes, ... }:
+        {
+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+          networking.extraHosts = ''
+            ${nodes.minio.networking.primaryIPAddress} acme.test
+          '';
+        };
+
+      minio =
+        { ... }:
+        {
+          security.pki.certificates = [
+            (builtins.readFile ../common/acme/server/ca.cert.pem)
+          ];
+
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+
+            virtualHosts."acme.test" = {
+              onlySSL = true;
+              sslCertificate = ../common/acme/server/acme.test.cert.pem;
+              sslCertificateKey = ../common/acme/server/acme.test.key.pem;
+              locations."/".proxyPass = "http://127.0.0.1:9000";
+            };
+          };
+
+          networking.extraHosts = ''
+            127.0.0.1 acme.test
+          '';
+
+          networking.firewall.allowedTCPPorts = [
+            9000
+            80
+            443
+          ];
+
           services.minio = {
             enable = true;
             listenAddress = "0.0.0.0:9000";
@@ -56,18 +111,22 @@ runTest (
     };
 
     test-helpers.init = ''
-      nextcloud.wait_for_open_port(9000)
+      minio.start()
+      minio.wait_for_open_port(9000)
+      minio.wait_for_unit("nginx.service")
+      minio.wait_for_open_port(443)
     '';
 
     test-helpers.extraTests =
       { nodes, ... }:
       ''
+
         with subtest("File is not on the filesystem"):
             nextcloud.succeed("test ! -e ${nodes.nextcloud.services.nextcloud.home}/data/root/files/test-shared-file")
 
         with subtest("Check if file is in S3"):
             nextcloud.succeed(
-                "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+                "mc config host add minio https://acme.test ${accessKey} ${secretKey} --api s3v4"
             )
             files = nextcloud.succeed('mc ls minio/nextcloud|sort').strip().split('\n')
 
@@ -100,8 +159,8 @@ runTest (
         with subtest("Test download from S3"):
             client.succeed(
                 "env AWS_ACCESS_KEY_ID=${accessKey} AWS_SECRET_ACCESS_KEY=${secretKey} "
-                + f"${lib.getExe pkgs.awscli2} s3 cp s3://nextcloud/{file} test --endpoint-url http://nextcloud:9000 "
-                + "--region us-east-1"
+                + f"${lib.getExe pkgs.awscli2} s3 cp s3://nextcloud/{file} test --endpoint-url https://acme.test "
+                + "--region us-east-1 --ca-bundle /etc/ssl/certs/ca-bundle.crt"
             )
 
             client.succeed("test hi = $(cat test)")

nixos/tests/nvidia-container-toolkit.nix

@@ -90,7 +90,10 @@ in
 {
   name = "nvidia-container-toolkit";
   meta = with lib.maintainers; {
-    maintainers = [ ereslibre ];
+    maintainers = [
+      ereslibre
+      christoph-heiss
+    ];
   };
   defaults =
     { config, ... }:

nixos/tests/syncthing-folders.nix

@@ -0,0 +1,135 @@
+{ lib, pkgs, ... }:
+let
+  genNodeId =
+    name:
+    pkgs.runCommand "syncthing-test-certs-${name}" { } ''
+      mkdir -p $out
+      ${pkgs.syncthing}/bin/syncthing generate --config=$out
+      ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id
+    '';
+  idA = genNodeId "a";
+  idB = genNodeId "b";
+  idC = genNodeId "c";
+  testPassword = "it's a secret";
+in
+{
+  name = "syncthing";
+  meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];
+
+  nodes = {
+    a =
+      { config, ... }:
+      {
+        environment.etc.bar-encryption-password.text = testPassword;
+        services.syncthing = {
+          enable = true;
+          openDefaultPorts = true;
+          cert = "${idA}/cert.pem";
+          key = "${idA}/key.pem";
+          settings = {
+            devices.b.id = lib.fileContents "${idB}/id";
+            devices.c.id = lib.fileContents "${idC}/id";
+            folders.foo = {
+              path = "/var/lib/syncthing/foo";
+              devices = [ "b" ];
+            };
+            folders.bar = {
+              path = "/var/lib/syncthing/bar";
+              devices = [
+                {
+                  name = "c";
+                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
+                }
+              ];
+            };
+          };
+        };
+      };
+    b =
+      { config, ... }:
+      {
+        environment.etc.bar-encryption-password.text = testPassword;
+        services.syncthing = {
+          enable = true;
+          openDefaultPorts = true;
+          cert = "${idB}/cert.pem";
+          key = "${idB}/key.pem";
+          settings = {
+            devices.a.id = lib.fileContents "${idA}/id";
+            devices.c.id = lib.fileContents "${idC}/id";
+            folders.foo = {
+              path = "/var/lib/syncthing/foo";
+              devices = [ "a" ];
+            };
+            folders.bar = {
+              path = "/var/lib/syncthing/bar";
+              devices = [
+                {
+                  name = "c";
+                  encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";
+                }
+              ];
+            };
+          };
+        };
+      };
+    c = {
+      services.syncthing = {
+        enable = true;
+        openDefaultPorts = true;
+        cert = "${idC}/cert.pem";
+        key = "${idC}/key.pem";
+        settings = {
+          devices.a.id = lib.fileContents "${idA}/id";
+          devices.b.id = lib.fileContents "${idB}/id";
+          folders.bar = {
+            path = "/var/lib/syncthing/bar";
+            devices = [
+              "a"
+              "b"
+            ];
+            type = "receiveencrypted";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    a.wait_for_unit("syncthing.service")
+    b.wait_for_unit("syncthing.service")
+    c.wait_for_unit("syncthing.service")
+    a.wait_for_open_port(22000)
+    b.wait_for_open_port(22000)
+    c.wait_for_open_port(22000)
+
+    # Test foo
+
+    a.wait_for_file("/var/lib/syncthing/foo")
+    b.wait_for_file("/var/lib/syncthing/foo")
+
+    a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")
+    b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")
+
+    a.wait_for_file("/var/lib/syncthing/foo/b2a")
+    b.wait_for_file("/var/lib/syncthing/foo/a2b")
+
+    # Test bar
+
+    a.wait_for_file("/var/lib/syncthing/bar")
+    b.wait_for_file("/var/lib/syncthing/bar")
+    c.wait_for_file("/var/lib/syncthing/bar")
+
+    a.succeed("echo plaincontent > /var/lib/syncthing/bar/plainname")
+
+    # B should be able to decrypt, check that content of file matches
+    b.wait_for_file("/var/lib/syncthing/bar/plainname")
+    file_contents = b.succeed("cat /var/lib/syncthing/bar/plainname")
+    assert "plaincontent\n" == file_contents, f"Unexpected file contents: {file_contents=}"
+
+    # Bar on C is untrusted, check that content is not in cleartext
+    c.fail("grep -R plaincontent /var/lib/syncthing/bar")
+  '';
+}

nixos/tests/teleports.nix

@@ -34,14 +34,20 @@
     machine.wait_for_x()
 
     with subtest("teleports launches"):
-        machine.execute("teleports >&2 &")
+        machine.succeed("teleports >&2 &")
+        machine.wait_for_console_text("authorizationStateWaitPhoneNumber")
+        machine.send_key("alt-f10")
+        machine.sleep(2)
         machine.wait_for_text(r"(TELEports|Phone Number)")
         machine.screenshot("teleports_open")
 
     machine.succeed("pkill -f teleports")
 
     with subtest("teleports localisation works"):
-        machine.execute("env LANG=de_DE.UTF-8 teleports >&2 &")
+        machine.succeed("env LANG=de_DE.UTF-8 teleports >&2 &")
+        machine.wait_for_console_text("authorizationStateWaitPhoneNumber")
+        machine.send_key("alt-f10")
+        machine.sleep(2)
         machine.wait_for_text("Telefonnummer")
         machine.screenshot("teleports_localised")
   '';

nixos/tests/vscodium.nix

@@ -62,14 +62,14 @@ let
           codium_running.wait() # type: ignore[union-attr]
           with codium_running: # type: ignore[union-attr]
               # Wait until vscodium is visible. "File" is in the menu bar.
-              machine.wait_for_text('Get Started with')
+              machine.wait_for_text('(Get|Started|with|Customize|theme)')
               machine.screenshot('start_screen')
 
               test_string = 'testfile'
 
               # Create a new file
               machine.send_key('ctrl-n')
-              machine.wait_for_text('Untitled')
+              machine.wait_for_text('(Untitled|Select|language|template|dismiss)')
               machine.screenshot('empty_editor')
 
               # Type a string

nixos/tests/web-apps/netbox-upgrade.nix

@@ -1,8 +1,18 @@
 import ../make-test-python.nix (
   { lib, pkgs, ... }:
   let
-    oldNetbox = pkgs.netbox_3_7;
-    newNetbox = pkgs.netbox_4_1;
+    oldNetbox = "netbox_4_1";
+    newNetbox = "netbox_4_2";
+
+    apiVersion =
+      version:
+      lib.pipe version [
+        (lib.splitString ".")
+        (lib.take 2)
+        (lib.concatStringsSep ".")
+      ];
+    oldApiVersion = apiVersion pkgs."${oldNetbox}".version;
+    newApiVersion = apiVersion pkgs."${newNetbox}".version;
   in
   {
     name = "netbox-upgrade";
@@ -15,12 +25,14 @@ import ../make-test-python.nix (
     };
 
     nodes.machine =
-      { config, ... }:
+      { config, pkgs, ... }:
       {
         virtualisation.memorySize = 2048;
         services.netbox = {
           enable = true;
-          package = oldNetbox;
+          # Pick the NetBox package from this config's "pkgs" argument,
+          # so that `nixpkgs.config.permittedInsecurePackages` works
+          package = pkgs."${oldNetbox}";
           secretKeyFile = pkgs.writeText "secret" ''
             abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
           '';
@@ -42,22 +54,13 @@ import ../make-test-python.nix (
 
         networking.firewall.allowedTCPPorts = [ 80 ];
 
-        specialisation.upgrade.configuration.services.netbox.package = lib.mkForce newNetbox;
+        nixpkgs.config.permittedInsecurePackages = [ pkgs."${oldNetbox}".name ];
+
+        specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs."${newNetbox}";
       };
 
     testScript =
       { nodes, ... }:
-      let
-        apiVersion =
-          version:
-          lib.pipe version [
-            (lib.splitString ".")
-            (lib.take 2)
-            (lib.concatStringsSep ".")
-          ];
-        oldApiVersion = apiVersion oldNetbox.version;
-        newApiVersion = apiVersion newNetbox.version;
-      in
       ''
         start_all()
         machine.wait_for_unit("netbox.target")

nixos/tests/web-apps/oncall.nix

@@ -0,0 +1,156 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  ldapDomain = "example.org";
+  ldapSuffix = "dc=example,dc=org";
+
+  ldapRootUser = "root";
+  ldapRootPassword = "foobar23";
+
+  testUser = "myuser";
+  testPassword = "foobar23";
+  teamName = "myteam";
+in
+{
+  name = "oncall";
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+  nodes = {
+    machine = {
+      virtualisation.memorySize = 2048;
+
+      environment.etc."oncall-secrets.yml".text = ''
+        auth:
+          ldap_bind_password: "${ldapRootPassword}"
+      '';
+
+      environment.systemPackages = [ pkgs.jq ];
+
+      services.oncall = {
+        enable = true;
+        settings = {
+          auth = {
+            module = "oncall.auth.modules.ldap_import";
+            ldap_url = "ldap://localhost";
+            ldap_user_suffix = "";
+            ldap_bind_user = "cn=${ldapRootUser},${ldapSuffix}";
+            ldap_base_dn = "ou=accounts,${ldapSuffix}";
+            ldap_search_filter = "(uid=%s)";
+            import_user = true;
+            attrs = {
+              username = "uid";
+              full_name = "cn";
+              email = "mail";
+              mobile = "telephoneNumber";
+              sms = "mobile";
+            };
+          };
+        };
+        secretFile = "/etc/oncall-secrets.yml";
+      };
+
+      services.openldap = {
+        enable = true;
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={1}mdb" = {
+              attrs = {
+                objectClass = [
+                  "olcDatabaseConfig"
+                  "olcMdbConfig"
+                ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/lib/openldap/db";
+                olcSuffix = ldapSuffix;
+                olcRootDN = "cn=${ldapRootUser},${ldapSuffix}";
+                olcRootPW = ldapRootPassword;
+              };
+            };
+          };
+        };
+        declarativeContents = {
+          ${ldapSuffix} = ''
+            dn: ${ldapSuffix}
+            objectClass: top
+            objectClass: dcObject
+            objectClass: organization
+            o: ${ldapDomain}
+
+            dn: ou=accounts,${ldapSuffix}
+            objectClass: top
+            objectClass: organizationalUnit
+
+            dn: uid=${testUser},ou=accounts,${ldapSuffix}
+            objectClass: top
+            objectClass: inetOrgPerson
+            uid: ${testUser}
+            userPassword: ${testPassword}
+            cn: Test User
+            sn: User
+            mail: test@example.org
+            telephoneNumber: 012345678910
+            mobile: 012345678910
+          '';
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("uwsgi.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_file("/run/uwsgi/oncall.sock")
+    machine.wait_for_unit("oncall-setup-database.service")
+
+    with subtest("Home screen loads"):
+        machine.succeed(
+            "curl -sSfL http://[::1]:80 | grep '<title>Oncall</title>'"
+        )
+
+    with subtest("Staticfiles can be fetched"):
+        machine.wait_until_succeeds(
+          "curl -sSfL http://[::1]:80/static/bundles/libs.js"
+        )
+
+    with subtest("Staticfiles are generated"):
+        machine.succeed(
+          "test -e /var/lib/oncall/static/bundles/libs.js"
+        )
+
+    with subtest("Create and verify team via REST API"):
+        import json
+
+        # Log in and store the session cookie
+        login_response = machine.succeed("""
+            curl -sSfL -c cookies -X POST \
+                --data-raw 'username=${testUser}&password=${testPassword}' \
+                http://[::1]:80/login
+        """)
+
+        # Parse csrf token
+        login_response_data = json.loads(login_response)
+        csrf_token = login_response_data["csrf_token"]
+
+        # Create the team
+        machine.succeed(
+          f"""curl -sSfL -b cookies -X POST -H 'Content-Type: application/json' -H 'X-CSRF-Token: {csrf_token}' -d '{{"name": "${teamName}", "email": "test@example.com", "scheduling_timezone": "Europe/Berlin", "iris_enabled": false}}' http://[::1]:80/api/v0/teams/"""
+        )
+
+        # Query the created team
+        machine.succeed("""
+            curl -sSfL -b cookies http://[::1]:80/api/v0/teams/${teamName} | jq -e '.name == "${teamName}"'
+        """)
+
+  '';
+}

pkgs/README.md

@@ -501,12 +501,12 @@ When using the `patches` parameter to `mkDerivation`, make sure the patch name c
 
 ### Fetching patches
 
-In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch`:
+In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch2`:
 
 ```nix
 {
   patches = [
-    (fetchpatch {
+    (fetchpatch2 {
       name = "fix-check-for-using-shared-freetype-lib.patch";
       url = "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/patch/?id=8f5d28536e4518716fdfe974e580194c8f57871d";
       hash = "sha256-uRcxaCjd+WAuGrXOmGfFeu79cUILwkRdBu48mwcBE7g=";
@@ -515,7 +515,7 @@ In the interest of keeping our maintenance burden and the size of Nixpkgs to a m
 }
 ```
 
-If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`. Check [the `fetchpatch` reference](https://nixos.org/manual/nixpkgs/unstable/#fetchpatch) for details.
+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch2`. Check [the `fetchpatch` reference](https://nixos.org/manual/nixpkgs/unstable/#fetchpatch) for details.
 
 When adding patches in this manner you should be reasonably sure that the used URL is stable. Patches referencing open pull requests will change when the PR is updated and code forges (such as GitHub) usually garbage collect commits that are no longer reachable due to rebases/amends.
 

pkgs/applications/audio/csound/default.nix

@@ -85,5 +85,6 @@ stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     maintainers = [ maintainers.marcweber ];
     platforms = platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "VoiceOfFaust";
-  version = "1.1.5";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "magnetophon";
     repo = "VoiceOfFaust";
-    rev = version;
-    sha256 = "sha256-vB8+ymvNuuovFXwOJ3BTIj5mGzCGa1+yhYs4nWMYIxU=";
+    tag = "V${version}";
+    sha256 = "sha256-wsc4yzytK2hPVBQwMhdhjnH1pDtpkNCFJnItyzszEs0=";
   };
 
   plugins = [
@@ -27,11 +27,15 @@ stdenv.mkDerivation rec {
 
   pitchTracker = puredata-with-plugins plugins;
 
-  buildInputs = [
+  nativeBuildInputs = [
     faust2jack
     faust2lv2
   ];
 
+  # ld: crtbegin.o: relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
+  # ld: failed to set dynamic section sizes: bad value
+  hardeningDisable = [ "pie" ];
+
   enableParallelBuilding = true;
 
   dontWrapQtApps = true;
@@ -41,15 +45,17 @@ stdenv.mkDerivation rec {
   ];
 
   patchPhase = ''
-    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/synthWrapper
     sed -i "s@jack_connect@${jack-example-tools}/bin/jack_connect@g" launchers/synthWrapper
+    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/pitchTracker
     sed -i "s@../PureData/OscSendVoc.pd@$out/bin/PureData/OscSendVoc.pd@g" launchers/pitchTracker
+    sed -i "s@pd -nodac@${pitchTracker}/bin/pd -nodac@g" launchers/pitchTrackerGUI
+    sed -i "s@../PureData/OscSendVoc.pd@$out/bin/PureData/OscSendVoc.pd@g" launchers/pitchTrackerGUI
   '';
 
   meta = {
     description = "Turn your voice into a synthesizer";
     homepage = "https://github.com/magnetophon/VoiceOfFaust";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.agpl3Only;
     maintainers = [ lib.maintainers.magnetophon ];
   };
 }

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -14,7 +14,7 @@
   libXtst,
   libsecret,
   gsettings-desktop-schemas,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   makeWrapper,
   perl,
   ...
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     libXtst
     libsecret
     zlib
-  ] ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0;
+  ] ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1;
 
   buildCommand = ''
     # Unpack tarball.
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
             libXtst
             libsecret
           ]
-          ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0
+          ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1
         )
       } \
       --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \

pkgs/applications/editors/eclipse/default.nix

@@ -16,7 +16,7 @@
   jdk,
   jdk8,
   gsettings-desktop-schemas,
-  webkitgtk_4_0 ? null, # for internal web browser
+  webkitgtk_4_1 ? null, # for internal web browser
   buildEnv,
   runCommand,
   callPackage,
@@ -64,7 +64,7 @@ let
       gtk
       libXtst
       gsettings-desktop-schemas
-      webkitgtk_4_0
+      webkitgtk_4_1
       makeWrapper
       ;
   };

pkgs/applications/editors/formiko/default.nix

@@ -10,7 +10,7 @@
   gtkspell3,
   librsvg,
   pygobject3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     gtkspell3
     librsvg
     pygobject3
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   # Needs a display

pkgs/applications/editors/jetbrains/bin/versions.json

@@ -11,18 +11,18 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "2d1e8d1b8639c29045161567bc3fc8cdfbd9c8fe549d2da92d25e9d9a75c408d",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.tar.gz",
-      "build_number": "251.23774.442"
+      "version": "2025.1.1",
+      "sha256": "2f747d7240d70b65ed98d736dbcd6ac2b98ac93aff993a63c5f8bd0f65918ac5",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.1.tar.gz",
+      "build_number": "251.25410.104"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "d64bb300274f2509dde9a3c73eb66f45d18158bf46c9e61d3dfc602de8f83b5d",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.tar.gz",
-      "build_number": "251.23774.426"
+      "version": "2025.1.2",
+      "sha256": "47d1c891a34f12f371aeab2364b9280766e1e99b27933f8d11c3c3832ed865ca",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.2.tar.gz",
+      "build_number": "251.25410.123"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
@@ -35,99 +35,99 @@
     "gateway": {
       "update-channel": "Gateway RELEASE",
       "url-template": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "d00276adceee00ea5555013778d3ed25254b60383d43e6d4b7f892b10681c673",
-      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.tar.gz",
-      "build_number": "251.23774.441"
+      "version": "2025.1.1",
+      "sha256": "edccd3d877407dfc628d9ba2a8ee767c11a861532dd4e0b1cb2a4d8787476ea8",
+      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.1.tar.gz",
+      "build_number": "251.25410.139"
     },
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "cc22617f9be233a13644d653f20cba29b05295bcb5bb77ac9621ee5447ae349a",
-      "url": "https://download.jetbrains.com/go/goland-2025.1.tar.gz",
-      "build_number": "251.23774.430"
+      "version": "2025.1.1",
+      "sha256": "fb94d5df43942db47a5506b50e511457cf845b986e70168171b9f5324b7d0d77",
+      "url": "https://download.jetbrains.com/go/goland-2025.1.1.tar.gz",
+      "build_number": "251.25410.140"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "d73a0182c9e9660789a6998a5f5743a6c2263e49aabd8ada1108efd575d9ec1e",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.tar.gz",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "36b72ac85e8e1536dfccb300b5a435461b1e2953585a90a5d8f06e1b263b0b5c",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.1.1.tar.gz",
+      "build_number": "251.25410.129"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "9946a690072f166607fd7b0d29e9e9c6a24c79fd5d7365a5600366b0b27532ec",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.tar.gz",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "337d34b20cdaa8da30d71b98e1b36817bdfe2f2245c491ef38f0cee02f0d0316",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.1.1.tar.gz",
+      "build_number": "251.25410.129"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3.2",
-      "sha256": "54896e4c0a22c2ca27815da40be80f70b40b0d45e86d9bce957e47316f2ad342",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.2.tar.gz",
-      "build_number": "243.24978.603"
+      "version": "2025.1",
+      "sha256": "0b6d8c0964dc18785437c14bd2ac7e000e07e39865680227d201cd9cad0ff8a8",
+      "url": "https://download.jetbrains.com/mps/2025.1/MPS-2025.1.tar.gz",
+      "build_number": "251.23774.423"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "2ead794b5bc6d31be4ad886788110e9d8e5c708e2e542b20d17a2407b9e58998",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.tar.gz",
-      "build_number": "251.23774.436",
+      "version": "2025.1.1",
+      "sha256": "b64722ea715db8566754978af617716016deaa2cda3521cf05e4a049e5bbf6a3",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.1.tar.gz",
+      "build_number": "251.25410.148",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "b0dc6661f2b415677bd61c09fa9197483aa412701ecc527c9237a213e3876247",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.tar.gz",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "d2df49f8ec2df88039f535e0d8706d35f608db3e58b9411f5e8e726536788237",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.1.tar.gz",
+      "build_number": "251.25410.122"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "1282907f134a726e17bb7fe8cb7088e406aa4fbf9d910def03633572f3a62f8c",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.tar.gz",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "b1e8660b1c947f3bb746d0736e1e9c247635fadedb52f230ef5c64862893ad0b",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.1.tar.gz",
+      "build_number": "251.25410.122"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "bd00eb4d43db2386c6219415b098b0fad5abca5796b813d44beeb76c23408260",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.tar.gz",
-      "build_number": "251.23774.437"
+      "version": "2025.1.2",
+      "sha256": "cdf8a824c7daa3247b09d76a29acb31cfa623b90643d3d2a814982cb0a32879d",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.2.tar.gz",
+      "build_number": "251.25410.119"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "6ad3960cf6a0fa88f3cfb6c166c1080ad7c3fb0f72f50379f9cafbe523813437",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.tar.gz",
-      "build_number": "251.23774.429"
+      "version": "2025.1.1",
+      "sha256": "f5014b52770be4d1c743c5a60f0e20d0dd1a1c172018180d05c0a22f1ffd1027",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.1.tar.gz",
+      "build_number": "251.25410.120"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "6c3e5c2cc45bfbfe631f6f34f87d45fbc3e3f97d12a8ca9e6de77beab230a210",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.tar.gz",
-      "build_number": "251.23774.445"
+      "version": "2025.1.2",
+      "sha256": "b2974feb5406153817797b7dc93baaafe35c7b3687d38091d5d1b5d010a03132",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.2.tar.gz",
+      "build_number": "251.25410.115"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
-      "version": "2025.1",
-      "sha256": "f181eb1348c04a60f860fd9ea9616261c6c012a7916e76380652d129e87503ea",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.tar.gz",
-      "build_number": "251.23774.424"
+      "version": "2025.1.1",
+      "sha256": "411b6d93e47d7743aa9189f4a3cab3956c573ce406908da5621f8dee0098ad99",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.1.tar.gz",
+      "build_number": "251.25410.117"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -150,18 +150,18 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "f5bfa7dc9fdcc69558695d0b58fe39e86c75d1b72985845649429c98ba761ff9",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.442"
+      "version": "2025.1.1",
+      "sha256": "dcd7373dc9dd941703d18ae602dd384ce6d154a90745c37c3358bf1f6b41ed2e",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.104"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "c8bdb2a1d79801889b50ce6de4e859c66a324fb8d3d9211130a7c7803b9f2696",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.426"
+      "version": "2025.1.2",
+      "sha256": "fb34b6469c96a54018b3c728f96787d03da0ec92c88a80f52e8f89a0eecc8d01",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.2-aarch64.tar.gz",
+      "build_number": "251.25410.123"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
@@ -174,99 +174,99 @@
     "gateway": {
       "update-channel": "Gateway RELEASE",
       "url-template": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "d2a6f62d639716fd718542e416e4129e03f44768d1495b6399731cbe44f037ea",
-      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.441"
+      "version": "2025.1.1",
+      "sha256": "869882db293640328f5e1ae80c5cf60183ba850f6087ab1b3cf95ec77b3837be",
+      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.139"
     },
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "f6b7f36efc9de54c83e49392882075868ba85b418a99cde47031795a79a30426",
-      "url": "https://download.jetbrains.com/go/goland-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.430"
+      "version": "2025.1.1",
+      "sha256": "949e86c6991e14d90adcaea75c18f679b1ab029ec0c00f00f464a631e999c036",
+      "url": "https://download.jetbrains.com/go/goland-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.140"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "168e2cb680db2ad34633ccea3539151d6fb74989a4b585250814ba65e56dabaa",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "7860b836a18b82827fdb54a86cc5601fe8ef28aab4253981f238ef975a982915",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.129"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "b269898937bb0c3309eeae34ca039cff9532867eb7ee787b577b11bb49c87bda",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "756baa32d72bd982d9b8c06f86cd42755d2677a9f1ea37bd6ad6a963d17226b2",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.129"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3.2",
-      "sha256": "54896e4c0a22c2ca27815da40be80f70b40b0d45e86d9bce957e47316f2ad342",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.2.tar.gz",
-      "build_number": "243.24978.603"
+      "version": "2025.1",
+      "sha256": "0b6d8c0964dc18785437c14bd2ac7e000e07e39865680227d201cd9cad0ff8a8",
+      "url": "https://download.jetbrains.com/mps/2025.1/MPS-2025.1.tar.gz",
+      "build_number": "251.23774.423"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "a55cbef6886a645e5dfcbead427d1d2b6997eca6b86c9f4e2eed828980bd822b",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.436",
+      "version": "2025.1.1",
+      "sha256": "6e479318f5627ec1d6ccd47610a93aa9e9a56c9badd2be4d8f935008d0e71b9e",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.148",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "49a4738e18129af75f90cd47744f9a46922a74d905f8e4060a531753a0496d6b",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "d717e039a91587e5396c69d056ebd91f640ae03ddf398e575c8f8eb3817d8afb",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.122"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "4879e9b70aef547fe4a7c846345f496dd1aeaf93be9a62455529409efff97f68",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "3f8f8a3773652ec99ea7a05b55dff41b5683548838f009e5e3d132ea644384d9",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.122"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "9d44cdaf7c344be547908e0a5073b49db7bf66d743b5d19dd2ad01ef7f25a0ed",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.437"
+      "version": "2025.1.2",
+      "sha256": "c1ad139252fd3158aa86e9ac4532db5d9dd653807fc9f1dc4458170f3f1c3de6",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.2-aarch64.tar.gz",
+      "build_number": "251.25410.119"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "8cf468eae2788a2076be630b1bfc8ac92efc60701617702acbf765346d6ac293",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.429"
+      "version": "2025.1.1",
+      "sha256": "00b7526795af4e7eba1c65fc5e10a963e717770e68c5bfd28b10163f9fa37f8c",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.120"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "e645f8929095be8ea83da911b55999ff3199daa6ba68ed32cabb1f3824ce301f",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.445"
+      "version": "2025.1.2",
+      "sha256": "4660f8f2fd37b166bae904385b863157ab596fac35869de17a39df999efde8ce",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.2-aarch64.tar.gz",
+      "build_number": "251.25410.115"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "version": "2025.1",
-      "sha256": "51fd7420fb49ff8851d3b4b1079f8d7afebe9631a76e7d1d4fd3e66d42332c6c",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1-aarch64.tar.gz",
-      "build_number": "251.23774.424"
+      "version": "2025.1.1",
+      "sha256": "0156affae3222afb51cfe8a82e1eabf26f62bd91a74a2822fa821afd1eab9bad",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.1-aarch64.tar.gz",
+      "build_number": "251.25410.117"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -289,18 +289,18 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "856658b830523f451b511d1c9d098287522fe4d31096093742286340411157e4",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.dmg",
-      "build_number": "251.23774.442"
+      "version": "2025.1.1",
+      "sha256": "e7558d0196390c18e2c11143aa59f2ad56c020d43ebd05057f997fa117abb484",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.1.dmg",
+      "build_number": "251.25410.104"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "15d893fe7dfc8a14bc8ce250b9113fad5c1752cdcad9c4e22cb013fc03a28dda",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.dmg",
-      "build_number": "251.23774.426"
+      "version": "2025.1.2",
+      "sha256": "a6b7dadb262813d867281d700456c7bca82b61bea99e52fd54edec05cd07180e",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.2.dmg",
+      "build_number": "251.25410.123"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
@@ -313,99 +313,99 @@
     "gateway": {
       "update-channel": "Gateway RELEASE",
       "url-template": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "3201f442143a52f2ad10d6b4cdbd0bb9d67dd7270b3e396919d8c0140196494c",
-      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.dmg",
-      "build_number": "251.23774.441"
+      "version": "2025.1.1",
+      "sha256": "c849cd16b77b5268ee2e8279bddf02c21a925a25885549d0b1922a785f18120f",
+      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.1.dmg",
+      "build_number": "251.25410.139"
     },
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "587e7a7e56672405b31252567d47eccbc39a5623ec2b8f4f8bf424b038396b86",
-      "url": "https://download.jetbrains.com/go/goland-2025.1.dmg",
-      "build_number": "251.23774.430"
+      "version": "2025.1.1",
+      "sha256": "0b00984d45430b37538bf9c55f8f93f1476f819fba1bdea2588ffd36d7e91cb3",
+      "url": "https://download.jetbrains.com/go/goland-2025.1.1.dmg",
+      "build_number": "251.25410.140"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "9b1fecf56c9d2263f87bced7bb9164669c4e811e958c827480a7144b491e4a52",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.dmg",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "ee1577a44930b94112819b200acd617cbb3efdfa039df7911094051e9a10e465",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.1.1.dmg",
+      "build_number": "251.25410.129"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "86c568d302a2a25185fd912d82c6e99e423767ea1442c716f0ee34292736c35d",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.dmg",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "eccd0ba3f9b1f2f680b946a3658830562fd4369dd11cc618b86671c8e237c375",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.1.1.dmg",
+      "build_number": "251.25410.129"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
-      "version": "2024.3.2",
-      "sha256": "09b69187d9feb5e17865fcdec88ce8a95c4933a8176e37a224c251b60d5aed01",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.2-macos.dmg",
-      "build_number": "243.24978.603"
+      "version": "2025.1",
+      "sha256": "1ddae8569c8a96beeb5e85d20f1eed9115ace532a1154b5624f526cb49ddeaa8",
+      "url": "https://download.jetbrains.com/mps/2025.1/MPS-2025.1-macos.dmg",
+      "build_number": "251.23774.423"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "9c3bcba68beb364f57fa674fc1c33c4ac7fc86d3835de7b33aed8cfd2dbbda33",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.dmg",
-      "build_number": "251.23774.436",
+      "version": "2025.1.1",
+      "sha256": "2f7c9b0ec1947c7bb2247fd3a949de9921e82e9a2801e388f6cf9d4421073dbd",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.1.dmg",
+      "build_number": "251.25410.148",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "75e447b1a0e047fe1666bcd840b05ea7a03a0abcab0c1a7775c304d2cdb70c60",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.dmg",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "3d439ad29771d8618b03f28497899f09a6eb696c96c789b54aac9ac1bfb4766c",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.1.dmg",
+      "build_number": "251.25410.122"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "3ee1462eb7fa52593c67a50374a9af9d0ab4d081aa3c7ed72305bcbb1285a16e",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.dmg",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "cd56a7e1072f4562e2d3ef67e70f227606376572634120170f5689d3b970b570",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.1.dmg",
+      "build_number": "251.25410.122"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "e7d2dab3620e597a5f8a96f0611e97a489d7edecc8475f1be3109d3f0ab11327",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.dmg",
-      "build_number": "251.23774.437"
+      "version": "2025.1.2",
+      "sha256": "23f3479d1cff5ee1726726bea866ff755b08930e9da43b7ad250e6cb620c1dcf",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.2.dmg",
+      "build_number": "251.25410.119"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "3908c735f5c8293afa9166e48b6d90d717d5e472a3810f5f721026df51e4b07b",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.dmg",
-      "build_number": "251.23774.429"
+      "version": "2025.1.1",
+      "sha256": "97b154079ef326c9a3ce229129d7d220faee30f266954288f74bf6f27ee43942",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.1.dmg",
+      "build_number": "251.25410.120"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "b0b41fbcb264aec50022800fb2930e3686d2f9dad07acc49621c85dfc3d4a193",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.dmg",
-      "build_number": "251.23774.445"
+      "version": "2025.1.2",
+      "sha256": "1419d2aac23965838e16c2bedc31851045f8b9d99ccf93594838a4e329059d92",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.2.dmg",
+      "build_number": "251.25410.115"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
-      "version": "2025.1",
-      "sha256": "6acb3058c55c400d7a8dffd56edfdedf85cd6cf68735728ff02f123eb6804ac5",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.dmg",
-      "build_number": "251.23774.424"
+      "version": "2025.1.1",
+      "sha256": "44363b71b4ad461c07c2c0ae8424f6efabe356b347a2974765f88549a8ee183c",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.1.dmg",
+      "build_number": "251.25410.117"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -428,18 +428,18 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "fdc89423f33affb7740ea6785977912e6030e9bccd06361e7b1a00b598e84f7e",
-      "url": "https://download.jetbrains.com/cpp/CLion-2025.1-aarch64.dmg",
-      "build_number": "251.23774.442"
+      "version": "2025.1.1",
+      "sha256": "475280e277cc94d18de228bf5f81ebd6ff14084c2e1d2b0db5b4612007dc46fe",
+      "url": "https://download.jetbrains.com/cpp/CLion-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.104"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "ae95080c1a8696bb4811dc4e18f195aa8f0c49d546ee7e4dbeaed1fe56d4d2ef",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1-aarch64.dmg",
-      "build_number": "251.23774.426"
+      "version": "2025.1.2",
+      "sha256": "6d12a59053db3dfa33079ac79b1ea263e5b3ec6fde01d1d803f6d27afea033de",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2025.1.2-aarch64.dmg",
+      "build_number": "251.25410.123"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
@@ -452,99 +452,99 @@
     "gateway": {
       "update-channel": "Gateway RELEASE",
       "url-template": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "51b25a295182bd916d0b3b2881cf3ebd1ed30577dd7c63253231c80a080df947",
-      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1-aarch64.dmg",
-      "build_number": "251.23774.441"
+      "version": "2025.1.1",
+      "sha256": "abad0e061896590bea9bd1d4bead2183be3c1e71d6dfcba89ce2408f34af3536",
+      "url": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.139"
     },
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "6c478fc82467dc3f9970bc03b8c035210a0eb73cef9e32b27d6cd0dac9e166b6",
-      "url": "https://download.jetbrains.com/go/goland-2025.1-aarch64.dmg",
-      "build_number": "251.23774.430"
+      "version": "2025.1.1",
+      "sha256": "52e62d5a616b6ab6bf36f0d40d1925e9f477fcf84e187a2a1194d56d5ccae6ec",
+      "url": "https://download.jetbrains.com/go/goland-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.140"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "051f322384f41dae627f0a2487f47a72e2c696ef38b5c256f4348aad0d47dffb",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1-aarch64.dmg",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "92ea35ebfcd9e34cd9bda0103ca036fe1f9eb900c005ae33a9295050ad636dae",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2025.1.1.1-aarch64.dmg",
+      "build_number": "251.25410.129"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "2877c9ec5cfef9afa09c489083aa4c93f400d35556953ee757a4ee599432c601",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1-aarch64.dmg",
-      "build_number": "251.23774.435"
+      "version": "2025.1.1.1",
+      "sha256": "5207878b28df2a13e4248c1936ee4fff7c89495e3d4ffdaa3b8da3f21548117e",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2025.1.1.1-aarch64.dmg",
+      "build_number": "251.25410.129"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg",
-      "version": "2024.3.2",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.2-macos-aarch64.dmg",
-      "sha256": "9e6b8fb53418cef55bdbc690cc1c817f39b12b81cc3985522c24ee7f6fa5c364",
-      "build_number": "243.24978.603"
+      "version": "2025.1",
+      "url": "https://download.jetbrains.com/mps/2025.1/MPS-2025.1-macos-aarch64.dmg",
+      "sha256": "cb2aaa6311252a655ef55f813d3dff78890c2a10cf0aeff885018c316390486b",
+      "build_number": "251.23774.423"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "f963bacc18282e83da5adb85d55d8a6db74b8636c5c88777031fe1f222cb6a07",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1-aarch64.dmg",
-      "build_number": "251.23774.436",
+      "version": "2025.1.1",
+      "sha256": "8bb7acf16076e4a32b522107bc359197bb2ee0eeebe0ed5feb1d25d9110830c1",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.148",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "16f53e8200e3c17f1ea99cae469b94110cbc159e2063be0c0ce5e8b2f0214190",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1-aarch64.dmg",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "4e493ce20dd840402ed040f4447d06cab62e59514b5ab2058e94421877f72270",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.122"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "8a0f796981c3df2cf19cdaa5aa75b2c3f45adf2e7b779c40d7043d6d8dbcebe3",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1-aarch64.dmg",
-      "build_number": "251.23774.444"
+      "version": "2025.1.1",
+      "sha256": "76a97e0d1ca75cbfbcc0acb046154daec1113010c052318077a128ff89fb55a6",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.122"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "8a3b452dd35ed1be8eca579de47f27febdc68271123a0557354ded179f53bce2",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1-aarch64.dmg",
-      "build_number": "251.23774.437"
+      "version": "2025.1.2",
+      "sha256": "ab6645bba503f0a9d67b2838d1dd88a81ad81dd34e6015ccaea30400c35659e4",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2025.1.2-aarch64.dmg",
+      "build_number": "251.25410.119"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "fe19db995e43fbd2b76a90ef31ef61ae15c2ba5a479d40a539d1f768245683f3",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1-aarch64.dmg",
-      "build_number": "251.23774.429"
+      "version": "2025.1.1",
+      "sha256": "6b8bd9c8ffeec01b0a907604d99cc77ede865aa9abf350e76957d9675ab8a810",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.120"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "4ee23c7ec5a85e8e42d9d74fb86e03ce9cac8e1d0c827df42360375fd912e81b",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1-aarch64.dmg",
-      "build_number": "251.23774.445"
+      "version": "2025.1.2",
+      "sha256": "3f12ad41285d6b67dcc577526976b5c394b44caa3f243147143968a505144a79",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2025.1.2-aarch64.dmg",
+      "build_number": "251.25410.115"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg",
-      "version": "2025.1",
-      "sha256": "a2de4c845644d51501d7045b33ecb4f88c045cf6aeceb316d95ed115d4945cb6",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1-aarch64.dmg",
-      "build_number": "251.23774.424"
+      "version": "2025.1.1",
+      "sha256": "7acfa46536b598b576775892ac46bb570dd06bc9461cc58c51b9efd4afd09139",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2025.1.1-aarch64.dmg",
+      "build_number": "251.25410.117"
     },
     "writerside": {
       "update-channel": "Writerside EAP",

pkgs/applications/editors/neovim/build-neovim-plugin.nix

@@ -26,6 +26,7 @@ let
 
   luaDrv = originalLuaDrv.overrideAttrs (oa: {
     version = attrs.version or oa.version;
+    __intentionallyOverridingVersion = true;
     rockspecVersion = oa.rockspecVersion;
 
     extraConfig = ''
@@ -43,6 +44,7 @@ let
           lua.pkgs.luarocksMoveDataFolder
         ];
         version = "${originalLuaDrv.version}-unstable-${oa.version}";
+        __intentionallyOverridingVersion = true;
       }
     )
   );

pkgs/applications/editors/rednotebook/default.nix

@@ -8,7 +8,7 @@
   gtk3,
   gtksourceview,
   pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   pygobject3,
   pyyaml,
   setuptools,
@@ -39,7 +39,7 @@ buildPythonApplication rec {
     gtk3
     gtksourceview
     pango
-    webkitgtk_4_0
+    webkitgtk_4_1
     pygobject3
     pyyaml
   ];