Merge cc50be1bf2 into haskell-updates

.devcontainer/devcontainer.json

@@ -5,7 +5,8 @@
     "ghcr.io/devcontainers/features/nix:1": {
       // fails in the devcontainer sandbox, enable sandbox via config instead
       "multiUser": false,
-      "packages": "nixd,nixfmt-unstable",
+      "packages": "nixpkgs.nixd,nixpkgs.nixfmt-rfc-style",
+      "useAttributePath": true,
       "extraNixConfig": "experimental-features = nix-command flakes,sandbox = true"
     }
   },
@@ -15,7 +16,9 @@
         "jnoortheen.nix-ide"
       ],
       "settings": {
-        "nix.formatterPath": "nixfmt-rfc-style",
+        "[nix]": {
+            "editor.formatOnSave": true
+        },
         "nix.enableLanguageServer": true,
         "nix.serverPath": "nixd"
       }

.git-blame-ignore-revs

@@ -251,3 +251,15 @@ fd14c067813572afc03ddbf7cdedc3eab5a59954
 
 # treewide format of all Nix files
 374e6bcc403e02a35e07b650463c01a52b13a7c8 # !autorebase nix-shell --run treefmt
+
+# nix: nixfmt-rfc-style
+a4f7e161b380b35b2f7bc432659a95fd71254ad8
+0812c9a321003c924868051d2b2e1934e8880f3f
+34f269c14ac18d89ddee9a8f54b1ca92a85bbcc6
+062c34cdace499aa44f0fa6ca6f2ca71769f6c43
+
+# haskellPackages.hercules-ci-agent (cabal2nix -> nixfmt-rfc-style)
+9314da7ee8d2aedfb15193b8c489da51efe52bb5
+
+# nix-builder-vm: nixfmt-rfc-style
+a034fb50f79816c6738fb48b48503b09ea3b0132

ci/OWNERS

@@ -299,6 +299,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/servers/http/nginx/ @raitobezarius
 /nixos/modules/services/web-servers/nginx/ @raitobezarius
 
+# D
+/pkgs/build-support/dlang @jtbx @TomaSajt
+
 # Dhall
 /pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
 /pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry

lib/systems/examples.nix

@@ -215,6 +215,10 @@ rec {
     config = "arm-none-eabi";
     libc = "newlib";
   };
+  arm-embedded-nano = {
+    config = "arm-none-eabi";
+    libc = "newlib-nano";
+  };
   armhf-embedded = {
     config = "arm-none-eabihf";
     libc = "newlib";

maintainers/maintainer-list.nix

@@ -194,7 +194,7 @@
   };
   _2hexed = {
     name = "n";
-    email = "2hexed@protonmail.com";
+    email = "twohexed@gmail.com";
     github = "2hexed";
     githubId = 54501296;
   };
@@ -3736,6 +3736,12 @@
     githubId = 510553;
     name = "Jos van Bakel";
   };
+  c31io = {
+    email = "celiogrand@outlook.com";
+    github = "c31io";
+    githubId = 83821760;
+    name = "Celio Grand";
+  };
   c4605 = {
     email = "bolasblack@gmail.com";
     github = "bolasblack";
@@ -10031,6 +10037,12 @@
     github = "I-Al-Istannen";
     githubId = 20284688;
   };
+  iamanaws = {
+    email = "nixpkgs.yjzaw@slmail.me";
+    github = "Iamanaws";
+    githubId = 78835633;
+    name = "Angel J";
+  };
   iammrinal0 = {
     email = "nixpkgs@mrinalpurohit.in";
     matrix = "@iammrinal0:nixos.dev";
@@ -10159,6 +10171,12 @@
     githubId = 7481521;
     name = "Balázs Lengyel";
   };
+  ilarvne = {
+    email = "ilarvne@proton.me";
+    github = "ilarvne";
+    githubId = 99905590;
+    name = "Nurali Aslanbekov";
+  };
   ilaumjd = {
     email = "ilaumjd@gmail.com";
     github = "ilaumjd";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -379,6 +379,21 @@
 
 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
 
+- `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.
+
+  Example:
+
+  ```nix
+  services.mysql = {
+    enable = true;
+    galeraCluster = {
+      enable = true;
+      localName = "Node 1";
+      localAddress = "galera_01";
+      nodeAddresses = [ "galera_01" "galera_02" "galera_03"];
+    };
+  };
+  ```
 
 - [`services.geoclue2`](#opt-services.geoclue2.enable) now has an `enableStatic` option, which allows the NixOS configuration to specify a fixed location for GeoClue to use.
 

nixos/modules/programs/bash/bash.nix

@@ -111,6 +111,20 @@ in
         internal = true;
       };
 
+      logout = lib.mkOption {
+        # Reset the title bar when logging out.  This protects against a remote
+        # NixOS system clobbering your local terminal's title bar when you SSH
+        # into the remote NixOS system and then log out.
+        #
+        # For more details, see: https://superuser.com/a/339946
+        default = ''
+          printf '\e]0;\a'
+        '';
+        description = ''
+          Shell script code called during login bash shell logout.
+        '';
+        type = lib.types.lines;
+      };
     };
 
   };
@@ -197,6 +211,21 @@ in
         fi
       '';
 
+      environment.etc.bash_logout.text = ''
+        # /etc/bash_logout: DO NOT EDIT -- this file has been generated automatically.
+
+        # Only execute this file once per shell.
+        if [ -n "$__ETC_BASHLOGOUT_SOURCED" ] || [ -n "$NOSYSBASHLOGOUT" ]; then return; fi
+        __ETC_BASHLOGOUT_SOURCED=1
+
+        ${cfg.logout}
+
+        # Read system-wide modifications.
+        if test -f /etc/bash_logout.local; then
+            . /etc/bash_logout.local
+        fi
+      '';
+
       # Configuration for readline in bash. We use "option default"
       # priority to allow user override using both .text and .source.
       environment.etc.inputrc.source = lib.mkOptionDefault ./inputrc;

nixos/modules/security/please.nix

@@ -122,6 +122,6 @@ in
       usshAuth = true;
     };
 
-    meta.maintainers = with lib.maintainers; [ azahi ];
+    meta.maintainers = [ ];
   };
 }

nixos/modules/services/audio/navidrome.nix

@@ -102,6 +102,11 @@ in
             mode = "700";
             inherit (cfg) user group;
           };
+          "${cfg.settings.MusicFolder or (WorkingDirectory + "/music")}"."d" = {
+            mode = ":700";
+            user = ":${cfg.user}";
+            group = ":${cfg.group}";
+          };
         };
         services.navidrome = {
           description = "Navidrome Media Server";

nixos/modules/services/databases/mysql.nix

@@ -320,6 +320,83 @@ in
           description = "Port number on which the MySQL master server runs.";
         };
       };
+
+      galeraCluster = {
+        enable = lib.mkEnableOption "MariaDB Galera Cluster";
+
+        package = lib.mkOption {
+          type = lib.types.package;
+          description = "The MariaDB Galera package that provides the shared library 'libgalera_smm.so' required for cluster functionality.";
+          default = lib.literalExpression "pkgs.mariadb-galera";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          description = "The logical name of the Galera cluster. All nodes in the same cluster must use the same name.";
+          default = "galera";
+        };
+
+        sstMethod = lib.mkOption {
+          type = lib.types.enum [
+            "rsync"
+            "mariabackup"
+          ];
+          description = "Method for the initial state transfer (wsrep_sst_method) when a node joins the cluster. Be aware that rsync needs SSH keys to be generated and authorized on all nodes!";
+          default = "rsync";
+          example = "mariabackup";
+        };
+
+        localName = lib.mkOption {
+          type = lib.types.str;
+          description = "The unique name that identifies this particular node within the cluster. Each node must have a different name.";
+          example = "node1";
+        };
+
+        localAddress = lib.mkOption {
+          type = lib.types.str;
+          description = "IP address or hostname of this node that will be used for cluster communication. Must be reachable by all other nodes.";
+          example = "1.2.3.4";
+          default = cfg.galeraCluster.localName;
+          defaultText = lib.literalExpression "config.services.mysql.galeraCluster.localName";
+        };
+
+        nodeAddresses = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "IP addresses or hostnames of all nodes in the cluster, including this node. This is used to construct the default clusterAddress connection string.";
+          example = lib.literalExpression ''["10.0.0.10" "10.0.0.20" "10.0.0.30"]'';
+          default = [ ];
+        };
+
+        clusterPassword = lib.mkOption {
+          type = lib.types.str;
+          description = "Optional password for securing cluster communications. If provided, it will be used in the clusterAddress for authentication between nodes.";
+          example = "SomePassword";
+          default = "";
+        };
+
+        clusterAddress = lib.mkOption {
+          type = lib.types.str;
+          description = "Full Galera cluster connection string. If nodeAddresses is set, this will be auto-generated, but you can override it with a custom value. Format is typically 'gcomm://node1,node2,node3' with optional parameters.";
+          example = "gcomm://10.0.0.10,10.0.0.20,10.0.0.30?gmcast.seg=1:SomePassword";
+          default =
+            if (cfg.galeraCluster.nodeAddresses == [ ]) then
+              ""
+            else
+              "gcomm://${builtins.concatStringsSep "," cfg.galeraCluster.nodeAddresses}"
+              + lib.optionalString (
+                cfg.galeraCluster.clusterPassword != ""
+              ) "?gmcast.seg=1:${cfg.galeraCluster.clusterPassword}";
+          defaultText = lib.literalExpression ''
+            if (config.services.mysql.galeraCluster.nodeAddresses == [ ]) then
+              ""
+            else
+              "gcomm://''${builtins.concatStringsSep \",\" config.services.mysql.galeraCluster.nodeAddresses}"
+              + lib.optionalString (config.services.mysql.galeraCluster.clusterPassword != "")
+                "?gmcast.seg=1:''${config.services.mysql.galeraCluster.clusterPassword}"
+          '';
+        };
+
+      };
     };
 
   };
@@ -327,6 +404,34 @@ in
   ###### implementation
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !cfg.galeraCluster.enable || isMariaDB;
+        message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
+      }
+      {
+        assertion =
+          !cfg.galeraCluster.enable
+          || (
+            cfg.galeraCluster.localAddress != ""
+            && (cfg.galeraCluster.nodeAddresses != [ ] || cfg.galeraCluster.clusterAddress != "")
+          );
+        message = "mariadb galera cluster is enabled but the localAddress and (nodeAddresses or clusterAddress) are not set";
+      }
+      {
+        assertion = !(cfg.galeraCluster.clusterAddress != "" && cfg.galeraCluster.clusterPassword != "");
+        message = "mariadb galera clusterPassword is set but overwritten by clusterAddress";
+      }
+      {
+        assertion =
+          !(
+            cfg.galeraCluster.enable
+            && cfg.galeraCluster.nodeAddresses != [ ]
+            && cfg.galeraCluster.clusterAddress != ""
+          );
+        message = "When services.mysql.galeraCluster.clusterAddress is set, setting services.mysql.galeraCluster.nodeAddresses is redundant and will be overwritten by clusterAddress. Choose one approach.";
+      }
+    ];
 
     services.mysql.dataDir = lib.mkDefault (
       if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"
@@ -351,8 +456,38 @@ in
       (lib.mkIf (!isMariaDB) {
         plugin-load-add = [ "auth_socket.so" ];
       })
+      (lib.mkIf cfg.galeraCluster.enable {
+        # Ensure Only InnoDB is used as galera clusters can only work with them
+        enforce_storage_engine = "InnoDB";
+        default_storage_engine = "InnoDB";
+
+        # galera only support this binlog format
+        binlog-format = "ROW";
+
+        bind_address = lib.mkDefault "0.0.0.0";
+      })
     ];
 
+    services.mysql.settings.galera = lib.optionalAttrs cfg.galeraCluster.enable {
+      wsrep_on = "ON";
+      wsrep_debug = lib.mkDefault "NONE";
+      wsrep_retry_autocommit = lib.mkDefault "3";
+      wsrep_provider = "${cfg.galeraCluster.package}/lib/galera/libgalera_smm.so";
+
+      wsrep_cluster_name = cfg.galeraCluster.name;
+      wsrep_cluster_address = cfg.galeraCluster.clusterAddress;
+
+      wsrep_node_address = cfg.galeraCluster.localAddress;
+      wsrep_node_name = "${cfg.galeraCluster.localName}";
+
+      # SST method using rsync
+      wsrep_sst_method = lib.mkDefault cfg.galeraCluster.sstMethod;
+      wsrep_sst_auth = lib.mkDefault "check_repl:check_pass";
+
+      binlog_format = "ROW";
+      innodb_autoinc_lock_mode = 2;
+    };
+
     users.users = lib.optionalAttrs (cfg.user == "mysql") {
       mysql = {
         description = "MySQL server user";
@@ -384,11 +519,29 @@ in
 
       unitConfig.RequiresMountsFor = cfg.dataDir;
 
-      path = [
-        # Needed for the mysql_install_db command in the preStart script
-        # which calls the hostname command.
-        pkgs.nettools
-      ];
+      path =
+        [
+          # Needed for the mysql_install_db command in the preStart script
+          # which calls the hostname command.
+          pkgs.nettools
+        ]
+        # tools 'wsrep_sst_rsync' needs
+        ++ lib.optionals cfg.galeraCluster.enable [
+          cfg.package
+          pkgs.bash
+          pkgs.gawk
+          pkgs.gnutar
+          pkgs.gzip
+          pkgs.inetutils
+          pkgs.iproute2
+          pkgs.netcat
+          pkgs.procps
+          pkgs.pv
+          pkgs.rsync
+          pkgs.socat
+          pkgs.stunnel
+          pkgs.which
+        ];
 
       preStart =
         if isMariaDB then
@@ -581,6 +734,17 @@ in
         })
       ];
     };
+
+    # Open firewall ports for MySQL (and Galera)
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.galeraCluster.enable [
+      3306 # MySQL
+      4567 # Galera Cluster
+      4568 # Galera IST
+      4444 # SST
+    ];
+    networking.firewall.allowedUDPPorts = lib.optionals cfg.galeraCluster.enable [
+      4567 # Galera Cluster
+    ];
   };
 
   meta.maintainers = [ lib.maintainers._6543 ];

nixos/modules/services/misc/taskchampion-sync-server.nix

@@ -22,6 +22,12 @@ in
       type = types.str;
       default = "taskchampion";
     };
+    host = lib.mkOption {
+      description = "Host address on which to serve";
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+    };
     port = lib.mkOption {
       description = "Port on which to serve";
       type = types.port;
@@ -79,7 +85,7 @@ in
         DynamicUser = false;
         ExecStart = ''
           ${lib.getExe cfg.package} \
-            --port ${builtins.toString cfg.port} \
+            --listen "${cfg.host}:${builtins.toString cfg.port}" \
             --data-dir ${cfg.dataDir} \
             --snapshot-versions ${builtins.toString cfg.snapshot.versions} \
             --snapshot-days ${builtins.toString cfg.snapshot.days} \

nixos/modules/services/networking/bird-lg.nix

@@ -187,7 +187,7 @@ in
         };
 
         extraArgs = lib.mkOption {
-          type = with lib.types; either lines (listOf str);
+          type = with lib.types; listOf str;
           default = [ ];
           description = ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#frontend).
@@ -247,14 +247,10 @@ in
         };
 
         extraArgs = lib.mkOption {
-          type = with lib.types; either lines (listOf str);
+          type = with lib.types; listOf str;
           default = [ ];
           description = ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#proxy).
-
-            :::{.note}
-            Passing lines (plain strings) is deprecated in favour of passing lists of strings.
-            :::
           '';
         };
       };
@@ -264,15 +260,6 @@ in
   ###### implementation
 
   config = {
-
-    warnings =
-      lib.optional (cfg.frontend.enable && builtins.isString cfg.frontend.extraArgs) ''
-        Passing strings to `services.bird-lg.frontend.extraOptions' is deprecated. Please pass a list of strings instead.
-      ''
-      ++ lib.optional (cfg.proxy.enable && builtins.isString cfg.proxy.extraArgs) ''
-        Passing strings to `services.bird-lg.proxy.extraOptions' is deprecated. Please pass a list of strings instead.
-      '';
-
     systemd.services = {
       bird-lg-frontend = lib.mkIf cfg.frontend.enable {
         enable = true;

nixos/modules/services/web-apps/homebox.nix

@@ -23,7 +23,8 @@ in
       defaultText = lib.literalExpression ''
         {
           HBOX_STORAGE_DATA = "/var/lib/homebox/data";
-          HBOX_STORAGE_SQLITE_URL = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
+          HBOX_DATABASE_DRIVER = "sqlite3";
+          HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
           HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
           HBOX_OPTIONS_CHECK_GITHUB_RELEASE = "false";
           HBOX_MODE = "production";
@@ -44,7 +45,8 @@ in
     users.groups.homebox = { };
     services.homebox.settings = {
       HBOX_STORAGE_DATA = mkDefault "/var/lib/homebox/data";
-      HBOX_STORAGE_SQLITE_URL = mkDefault "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
+      HBOX_DATABASE_DRIVER = mkDefault "sqlite3";
+      HBOX_DATABASE_SQLITE_PATH = mkDefault "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
       HBOX_OPTIONS_ALLOW_REGISTRATION = mkDefault "false";
       HBOX_OPTIONS_CHECK_GITHUB_RELEASE = mkDefault "false";
       HBOX_MODE = mkDefault "production";

nixos/modules/services/web-apps/part-db.nix

@@ -27,7 +27,7 @@ in
     phpPackage = mkPackageOption pkgs "php" { } // {
       apply =
         pkg:
-        pkg.override {
+        pkg.buildEnv {
           extraConfig = ''
             memory_limit = 256M;
           '';

nixos/tests/all-tests.nix

@@ -208,7 +208,7 @@ in
   armagetronad = runTest ./armagetronad.nix;
   artalk = runTest ./artalk.nix;
   atd = runTest ./atd.nix;
-  atop = handleTest ./atop.nix { };
+  atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
   audiobookshelf = runTest ./audiobookshelf.nix;
@@ -274,8 +274,8 @@ in
   cadvisor = handleTestOn [ "x86_64-linux" ] ./cadvisor.nix { };
   cage = handleTest ./cage.nix { };
   cagebreak = handleTest ./cagebreak.nix { };
-  calibre-web = handleTest ./calibre-web.nix { };
-  calibre-server = handleTest ./calibre-server.nix { };
+  calibre-web = runTest ./calibre-web.nix;
+  calibre-server = import ./calibre-server.nix { inherit pkgs runTest; };
   canaille = handleTest ./canaille.nix { };
   castopod = handleTest ./castopod.nix { };
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
@@ -511,12 +511,12 @@ in
   gemstash = handleTest ./gemstash.nix { };
   geoclue2 = runTest ./geoclue2.nix;
   geoserver = runTest ./geoserver.nix;
-  gerrit = handleTest ./gerrit.nix { };
+  gerrit = runTest ./gerrit.nix;
   geth = handleTest ./geth.nix { };
   ghostunnel = handleTest ./ghostunnel.nix { };
   gitdaemon = handleTest ./gitdaemon.nix { };
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
-  github-runner = handleTest ./github-runner.nix { };
+  github-runner = runTest ./github-runner.nix;
   gitlab = runTest ./gitlab.nix;
   gitolite = handleTest ./gitolite.nix { };
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix { };
@@ -524,7 +524,7 @@ in
   glances = runTest ./glances.nix;
   glitchtip = runTest ./glitchtip.nix;
   glusterfs = handleTest ./glusterfs.nix { };
-  gnome = handleTest ./gnome.nix { };
+  gnome = runTest ./gnome.nix;
   gnome-extensions = handleTest ./gnome-extensions.nix { };
   gnome-flashback = handleTest ./gnome-flashback.nix { };
   gnome-xorg = handleTest ./gnome-xorg.nix { };
@@ -675,7 +675,7 @@ in
   keycloak = discoverTests (import ./keycloak.nix);
   keyd = handleTest ./keyd.nix { };
   keymap = handleTest ./keymap.nix { };
-  kimai = handleTest ./kimai.nix { };
+  kimai = runTest ./kimai.nix;
   kmonad = runTest ./kmonad.nix;
   knot = runTest ./knot.nix;
   komga = handleTest ./komga.nix { };
@@ -741,7 +741,7 @@ in
   magnetico = handleTest ./magnetico.nix { };
   mailcatcher = runTest ./mailcatcher.nix;
   mailhog = handleTest ./mailhog.nix { };
-  mailpit = handleTest ./mailpit.nix { };
+  mailpit = runTest ./mailpit.nix;
   mailman = handleTest ./mailman.nix { };
   man = handleTest ./man.nix { };
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix { };
@@ -807,7 +807,7 @@ in
   mpv = runTest ./mpv.nix;
   mtp = handleTest ./mtp.nix { };
   multipass = handleTest ./multipass.nix { };
-  mumble = handleTest ./mumble.nix { };
+  mumble = runTest ./mumble.nix;
   # Fails on aarch64-linux at the PDF creation step - need to debug this on an
   # aarch64 machine..
   musescore = handleTestOn [ "x86_64-linux" ] ./musescore.nix { };
@@ -1412,7 +1412,7 @@ in
   wakapi = runTest ./wakapi.nix;
   warzone2100 = handleTest ./warzone2100.nix { };
   wasabibackend = handleTest ./wasabibackend.nix { };
-  wastebin = handleTest ./wastebin.nix { };
+  wastebin = runTest ./wastebin.nix;
   watchdogd = handleTest ./watchdogd.nix { };
   webhook = runTest ./webhook.nix;
   weblate = handleTest ./web-apps/weblate.nix { };

nixos/tests/atop.nix

@@ -1,12 +1,9 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
 let
   assertions = rec {
     path = program: path: ''
@@ -129,7 +126,7 @@ let
   };
 in
 {
-  justThePackage = makeTest {
+  justThePackage = runTest {
     name = "atop-justThePackage";
     nodes.machine = {
       environment.systemPackages = [ pkgs.atop ];
@@ -148,7 +145,7 @@ in
       ];
     inherit meta;
   };
-  defaults = makeTest {
+  defaults = runTest {
     name = "atop-defaults";
     nodes.machine = {
       programs.atop = {
@@ -169,7 +166,7 @@ in
       ];
     inherit meta;
   };
-  minimal = makeTest {
+  minimal = runTest {
     name = "atop-minimal";
     nodes.machine = {
       programs.atop = {
@@ -193,7 +190,7 @@ in
       ];
     inherit meta;
   };
-  netatop = makeTest {
+  netatop = runTest {
     name = "atop-netatop";
     nodes.machine = {
       programs.atop = {
@@ -215,7 +212,7 @@ in
       ];
     inherit meta;
   };
-  atopgpu = makeTest {
+  atopgpu = runTest {
     name = "atop-atopgpu";
     nodes.machine = {
       programs.atop = {
@@ -237,7 +234,7 @@ in
       ];
     inherit meta;
   };
-  everything = makeTest {
+  everything = runTest {
     name = "atop-everything";
     nodes.machine = {
       programs.atop = {

nixos/tests/calibre-server.nix

@@ -1,11 +1,10 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  ...
 }:
 
 let
-  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
   inherit (pkgs.lib)
     concatStringsSep
     maintainers
@@ -74,7 +73,7 @@ let
 in
 mapAttrs (
   test: testConfig:
-  (makeTest (
+  (runTest (
     let
       nodeName = testConfig.nodeName or test;
       calibreConfig = {

nixos/tests/calibre-web.nix

@@ -1,44 +1,42 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+{ lib, ... }:
 
-  let
-    port = 3142;
-    defaultPort = 8083;
-  in
-  {
-    name = "calibre-web";
-    meta.maintainers = with lib.maintainers; [ pborzenkov ];
+let
+  port = 3142;
+  defaultPort = 8083;
+in
+{
+  name = "calibre-web";
+  meta.maintainers = with lib.maintainers; [ pborzenkov ];
 
-    nodes = {
-      customized =
-        { pkgs, ... }:
-        {
-          services.calibre-web = {
-            enable = true;
-            listen.port = port;
-            options = {
-              calibreLibrary = "/tmp/books";
-              reverseProxyAuth = {
-                enable = true;
-                header = "X-User";
-              };
+  nodes = {
+    customized =
+      { pkgs, ... }:
+      {
+        services.calibre-web = {
+          enable = true;
+          listen.port = port;
+          options = {
+            calibreLibrary = "/tmp/books";
+            reverseProxyAuth = {
+              enable = true;
+              header = "X-User";
             };
           };
-          environment.systemPackages = [ pkgs.calibre ];
         };
-    };
-    testScript = ''
-      start_all()
+        environment.systemPackages = [ pkgs.calibre ];
+      };
+  };
+  testScript = ''
+    start_all()
 
-      customized.succeed(
-          "mkdir /tmp/books && calibredb --library-path /tmp/books add -e --title test-book"
-      )
-      customized.succeed("systemctl restart calibre-web")
-      customized.wait_for_unit("calibre-web.service")
-      customized.wait_for_open_port(${toString port})
-      customized.succeed(
-          "curl --fail -H X-User:admin 'http://localhost:${toString port}' | grep test-book"
-      )
-    '';
-  }
-)
+    customized.succeed(
+        "mkdir /tmp/books && calibredb --library-path /tmp/books add -e --title test-book"
+    )
+    customized.succeed("systemctl restart calibre-web")
+    customized.wait_for_unit("calibre-web.service")
+    customized.wait_for_open_port(${toString port})
+    customized.succeed(
+        "curl --fail -H X-User:admin 'http://localhost:${toString port}' | grep test-book"
+    )
+  '';
+}

nixos/tests/gerrit.nix

@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "gerrit";
+{
+  name = "gerrit";
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        flokli
-        zimbatm
-      ];
-    };
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      flokli
+      zimbatm
+    ];
+  };
 
-    nodes = {
-      server =
-        { config, pkgs, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [
-            80
-            2222
+  nodes = {
+    server =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [
+          80
+          2222
+        ];
+
+        services.gerrit = {
+          enable = true;
+          serverId = "aa76c84b-50b0-4711-a0a0-1ee30e45bbd0";
+          listenAddress = "[::]:80";
+          jvmHeapLimit = "1g";
+
+          builtinPlugins = [
+            "hooks"
+            "webhooks"
           ];
-
-          services.gerrit = {
-            enable = true;
-            serverId = "aa76c84b-50b0-4711-a0a0-1ee30e45bbd0";
-            listenAddress = "[::]:80";
-            jvmHeapLimit = "1g";
-
-            builtinPlugins = [
-              "hooks"
-              "webhooks"
-            ];
-            settings = {
-              gerrit.canonicalWebUrl = "http://server";
-              sshd.listenAddress = "[::]:2222";
-              sshd.advertisedAddress = "[::]:2222";
-            };
+          settings = {
+            gerrit.canonicalWebUrl = "http://server";
+            sshd.listenAddress = "[::]:2222";
+            sshd.advertisedAddress = "[::]:2222";
           };
         };
+      };
 
-      client =
-        { ... }:
-        {
-        };
-    };
+    client =
+      { ... }:
+      {
+      };
+  };
 
-    testScript = ''
-      start_all()
-      server.wait_for_unit("gerrit.service")
-      server.wait_for_open_port(80)
-      client.succeed("curl http://server")
+  testScript = ''
+    start_all()
+    server.wait_for_unit("gerrit.service")
+    server.wait_for_open_port(80)
+    client.succeed("curl http://server")
 
-      server.wait_for_open_port(2222)
-      client.succeed("nc -z server 2222")
-    '';
-  }
-)
+    server.wait_for_open_port(2222)
+    client.succeed("nc -z server 2222")
+  '';
+}

nixos/tests/github-runner.nix

@@ -1,49 +1,47 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "github-runner";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ veehaitch ];
-    };
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.github-runners.test = {
-          enable = true;
-          url = "https://github.com/yaxitech";
-          tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
-        };
-
-        services.github-runners.test-disabled = {
-          enable = false;
-          url = "https://github.com/yaxitech";
-          tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
-        };
-
-        systemd.services.dummy-github-com = {
-          wantedBy = [ "multi-user.target" ];
-          before = [ "github-runner-test.service" ];
-          script = "${pkgs.netcat}/bin/nc -Fl 443 | true && touch /tmp/registration-connect";
-        };
-        networking.hosts."127.0.0.1" = [ "api.github.com" ];
+{ pkgs, ... }:
+{
+  name = "github-runner";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ veehaitch ];
+  };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.github-runners.test = {
+        enable = true;
+        url = "https://github.com/yaxitech";
+        tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
       };
 
-    testScript = ''
-      start_all()
+      services.github-runners.test-disabled = {
+        enable = false;
+        url = "https://github.com/yaxitech";
+        tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
+      };
 
-      machine.wait_for_unit("dummy-github-com")
+      systemd.services.dummy-github-com = {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "github-runner-test.service" ];
+        script = "${pkgs.netcat}/bin/nc -Fl 443 | true && touch /tmp/registration-connect";
+      };
+      networking.hosts."127.0.0.1" = [ "api.github.com" ];
+    };
 
-      try:
-        machine.wait_for_unit("github-runner-test")
-      except Exception:
-        pass
+  testScript = ''
+    start_all()
 
-      out = machine.succeed("journalctl -u github-runner-test")
-      assert "Self-hosted runner registration" in out, "did not read runner registration header"
+    machine.wait_for_unit("dummy-github-com")
 
-      machine.wait_until_succeeds("test -f /tmp/registration-connect")
+    try:
+      machine.wait_for_unit("github-runner-test")
+    except Exception:
+      pass
 
-      machine.fail("systemctl list-unit-files | grep test-disabled")
-    '';
-  }
-)
+    out = machine.succeed("journalctl -u github-runner-test")
+    assert "Self-hosted runner registration" in out, "did not read runner registration header"
+
+    machine.wait_until_succeeds("test -f /tmp/registration-connect")
+
+    machine.fail("systemctl list-unit-files | grep test-disabled")
+  '';
+}

nixos/tests/gnome.nix

@@ -1,103 +1,101 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "gnome";
-    meta.maintainers = lib.teams.gnome.members;
+{ pkgs, lib, ... }:
+{
+  name = "gnome";
+  meta.maintainers = lib.teams.gnome.members;
 
-    nodes.machine =
-      { ... }:
+  nodes.machine =
+    { ... }:
 
-      {
-        imports = [ ./common/user-account.nix ];
+    {
+      imports = [ ./common/user-account.nix ];
 
-        services.xserver.enable = true;
-
-        services.xserver.displayManager = {
-          gdm.enable = true;
-          gdm.debug = true;
-        };
-
-        services.displayManager.autoLogin = {
-          enable = true;
-          user = "alice";
-        };
-
-        services.xserver.desktopManager.gnome.enable = true;
-        services.xserver.desktopManager.gnome.debug = true;
-
-        systemd.user.services = {
-          "org.gnome.Shell@wayland" = {
-            serviceConfig = {
-              ExecStart = [
-                # Clear the list before overriding it.
-                ""
-                # Eval API is now internal so Shell needs to run in unsafe mode.
-                # TODO: improve test driver so that it supports openqa-like manipulation
-                # that would allow us to drop this mess.
-                "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
-              ];
-            };
-          };
-        };
+      services.xserver.enable = true;
 
+      services.xserver.displayManager = {
+        gdm.enable = true;
+        gdm.debug = true;
       };
 
-    testScript =
-      { nodes, ... }:
-      let
-        # Keep line widths somewhat manageable
-        user = nodes.machine.users.users.alice;
-        uid = toString user.uid;
-        bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
-        # Run a command in the appropriate user environment
-        run = command: "su - ${user.name} -c '${bus} ${command}'";
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
 
-        # Call javascript in gnome shell, returns a tuple (success, output), where
-        # `success` is true if the dbus call was successful and output is what the
-        # javascript evaluates to.
-        eval =
-          command:
-          run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
+      services.xserver.desktopManager.gnome.enable = true;
+      services.xserver.desktopManager.gnome.debug = true;
 
-        # False when startup is done
-        startingUp = eval "Main.layoutManager._startingUp";
+      systemd.user.services = {
+        "org.gnome.Shell@wayland" = {
+          serviceConfig = {
+            ExecStart = [
+              # Clear the list before overriding it.
+              ""
+              # Eval API is now internal so Shell needs to run in unsafe mode.
+              # TODO: improve test driver so that it supports openqa-like manipulation
+              # that would allow us to drop this mess.
+              "${pkgs.gnome-shell}/bin/gnome-shell --unsafe-mode"
+            ];
+          };
+        };
+      };
 
-        # Start Console
-        launchConsole = run "gapplication launch org.gnome.Console";
+    };
 
-        # Hopefully Console's wm class
-        wmClass = eval "global.display.focus_window.wm_class";
-      in
-      ''
-        with subtest("Login to GNOME with GDM"):
-            # wait for gdm to start
-            machine.wait_for_unit("display-manager.service")
-            # wait for the wayland server
-            machine.wait_for_file("/run/user/${uid}/wayland-0")
-            # wait for alice to be logged in
-            machine.wait_for_unit("default.target", "${user.name}")
-            # check that logging in has given the user ownership of devices
-            assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+  testScript =
+    { nodes, ... }:
+    let
+      # Keep line widths somewhat manageable
+      user = nodes.machine.users.users.alice;
+      uid = toString user.uid;
+      bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
+      # Run a command in the appropriate user environment
+      run = command: "su - ${user.name} -c '${bus} ${command}'";
 
-        with subtest("Wait for GNOME Shell"):
-            # correct output should be (true, 'false')
-            machine.wait_until_succeeds(
-                "${startingUp} | grep -q 'true,..false'"
-            )
+      # Call javascript in gnome shell, returns a tuple (success, output), where
+      # `success` is true if the dbus call was successful and output is what the
+      # javascript evaluates to.
+      eval =
+        command:
+        run "gdbus call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval ${command}";
 
-        with subtest("Open Console"):
-            # Close the Activities view so that Shell can correctly track the focused window.
-            machine.send_key("esc")
+      # False when startup is done
+      startingUp = eval "Main.layoutManager._startingUp";
 
-            machine.succeed(
-                "${launchConsole}"
-            )
-            # correct output should be (true, '"org.gnome.Console"')
-            machine.wait_until_succeeds(
-                "${wmClass} | grep -q 'true,...org.gnome.Console'"
-            )
-            machine.sleep(20)
-            machine.screenshot("screen")
-      '';
-  }
-)
+      # Start Console
+      launchConsole = run "gapplication launch org.gnome.Console";
+
+      # Hopefully Console's wm class
+      wmClass = eval "global.display.focus_window.wm_class";
+    in
+    ''
+      with subtest("Login to GNOME with GDM"):
+          # wait for gdm to start
+          machine.wait_for_unit("display-manager.service")
+          # wait for the wayland server
+          machine.wait_for_file("/run/user/${uid}/wayland-0")
+          # wait for alice to be logged in
+          machine.wait_for_unit("default.target", "${user.name}")
+          # check that logging in has given the user ownership of devices
+          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
+
+      with subtest("Wait for GNOME Shell"):
+          # correct output should be (true, 'false')
+          machine.wait_until_succeeds(
+              "${startingUp} | grep -q 'true,..false'"
+          )
+
+      with subtest("Open Console"):
+          # Close the Activities view so that Shell can correctly track the focused window.
+          machine.send_key("esc")
+
+          machine.succeed(
+              "${launchConsole}"
+          )
+          # correct output should be (true, '"org.gnome.Console"')
+          machine.wait_until_succeeds(
+              "${wmClass} | grep -q 'true,...org.gnome.Console'"
+          )
+          machine.sleep(20)
+          machine.screenshot("screen")
+    '';
+}

nixos/tests/kimai.nix

@@ -1,23 +1,21 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "kimai";
-    meta.maintainers = with lib.maintainers; [ peat-psuwit ];
+{
+  name = "kimai";
+  meta.maintainers = with lib.maintainers; [ peat-psuwit ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.kimai.sites."localhost" = {
-          database.createLocally = true;
-        };
+  nodes.machine =
+    { ... }:
+    {
+      services.kimai.sites."localhost" = {
+        database.createLocally = true;
       };
+    };
 
-    testScript = ''
-      machine.wait_for_unit("phpfpm-kimai-localhost.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_open_port(80)
-      machine.succeed("curl -v --location --fail http://localhost/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("phpfpm-kimai-localhost.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    machine.succeed("curl -v --location --fail http://localhost/")
+  '';
+}

nixos/tests/mailpit.nix

@@ -1,35 +1,33 @@
-import ./make-test-python.nix (
-  { lib, ... }:
-  {
-    name = "mailpit";
-    meta.maintainers = lib.teams.flyingcircus.members;
+{ lib, ... }:
+{
+  name = "mailpit";
+  meta.maintainers = lib.teams.flyingcircus.members;
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.mailpit.instances.default = { };
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.mailpit.instances.default = { };
 
-        environment.systemPackages = with pkgs; [ swaks ];
-      };
+      environment.systemPackages = with pkgs; [ swaks ];
+    };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      from json import loads
+    from json import loads
 
-      machine.wait_for_unit("mailpit-default.service")
-      machine.wait_for_open_port(1025)
-      machine.wait_for_open_port(8025)
-      machine.succeed(
-          'echo "this is the body of the email" | swaks --to root@example.org --body - --server localhost:1025'
-      )
+    machine.wait_for_unit("mailpit-default.service")
+    machine.wait_for_open_port(1025)
+    machine.wait_for_open_port(8025)
+    machine.succeed(
+        'echo "this is the body of the email" | swaks --to root@example.org --body - --server localhost:1025'
+    )
 
-      received = loads(machine.succeed("curl http://localhost:8025/api/v1/messages"))
-      assert received['total'] == 1
-      message = received["messages"][0]
-      assert len(message['To']) == 1
-      assert message['To'][0]['Address'] == 'root@example.org'
-      assert "this is the body of the email" in message['Snippet']
-    '';
-  }
-)
+    received = loads(machine.succeed("curl http://localhost:8025/api/v1/messages"))
+    assert received['total'] == 1
+    message = received["messages"][0]
+    assert len(message['To']) == 1
+    assert message['To'][0]['Address'] == 'root@example.org'
+    assert "this is the body of the email" in message['Snippet']
+  '';
+}

nixos/tests/mumble.nix

@@ -1,95 +1,93 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  let
-    client =
-      { pkgs, ... }:
+let
+  client =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = [ pkgs.mumble ];
+    };
+
+  # outside of tests, this file should obviously not come from the nix store
+  envFile = pkgs.writeText "nixos-test-mumble-murmurd.env" ''
+    MURMURD_PASSWORD=testpassword
+  '';
+
+in
+{
+  name = "mumble";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ thoughtpolice ];
+  };
+
+  nodes = {
+    server =
+      { config, ... }:
       {
-        imports = [ ./common/x11.nix ];
-        environment.systemPackages = [ pkgs.mumble ];
+        security.apparmor.enable = true;
+        services.murmur.enable = true;
+        services.murmur.registerName = "NixOS tests";
+        services.murmur.password = "$MURMURD_PASSWORD";
+        services.murmur.environmentFile = envFile;
+        networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
       };
 
-    # outside of tests, this file should obviously not come from the nix store
-    envFile = pkgs.writeText "nixos-test-mumble-murmurd.env" ''
-      MURMURD_PASSWORD=testpassword
-    '';
+    client1 = client;
+    client2 = client;
+  };
 
-  in
-  {
-    name = "mumble";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ thoughtpolice ];
-    };
+  testScript = ''
+    start_all()
 
-    nodes = {
-      server =
-        { config, ... }:
-        {
-          security.apparmor.enable = true;
-          services.murmur.enable = true;
-          services.murmur.registerName = "NixOS tests";
-          services.murmur.password = "$MURMURD_PASSWORD";
-          services.murmur.environmentFile = envFile;
-          networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
-        };
+    server.wait_for_unit("murmur.service")
+    client1.wait_for_x()
+    client2.wait_for_x()
 
-      client1 = client;
-      client2 = client;
-    };
+    client1.execute("mumble mumble://client1:testpassword\@server/test >&2 &")
+    client2.execute("mumble mumble://client2:testpassword\@server/test >&2 &")
 
-    testScript = ''
-      start_all()
+    # cancel client audio configuration
+    client1.wait_for_window(r"Audio Tuning Wizard")
+    client2.wait_for_window(r"Audio Tuning Wizard")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_key("esc")
+    client2.send_key("esc")
 
-      server.wait_for_unit("murmur.service")
-      client1.wait_for_x()
-      client2.wait_for_x()
+    # cancel client cert configuration
+    client1.wait_for_window(r"Certificate Management")
+    client2.wait_for_window(r"Certificate Management")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_key("esc")
+    client2.send_key("esc")
 
-      client1.execute("mumble mumble://client1:testpassword\@server/test >&2 &")
-      client2.execute("mumble mumble://client2:testpassword\@server/test >&2 &")
+    # accept server certificate
+    client1.wait_for_window(r"^Mumble$")
+    client2.wait_for_window(r"^Mumble$")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_chars("y")
+    client2.send_chars("y")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
 
-      # cancel client audio configuration
-      client1.wait_for_window(r"Audio Tuning Wizard")
-      client2.wait_for_window(r"Audio Tuning Wizard")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_key("esc")
-      client2.send_key("esc")
+    # sometimes the wrong of the 2 windows is focused, we switch focus and try pressing "y" again
+    client1.send_key("alt-tab")
+    client2.send_key("alt-tab")
+    server.sleep(5)  # wait because mumble is slow to register event handlers
+    client1.send_chars("y")
+    client2.send_chars("y")
 
-      # cancel client cert configuration
-      client1.wait_for_window(r"Certificate Management")
-      client2.wait_for_window(r"Certificate Management")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_key("esc")
-      client2.send_key("esc")
+    # Find clients in logs
+    server.wait_until_succeeds(
+        "journalctl -eu murmur -o cat | grep -q 'client1.\+Authenticated'"
+    )
+    server.wait_until_succeeds(
+        "journalctl -eu murmur -o cat | grep -q 'client2.\+Authenticated'"
+    )
 
-      # accept server certificate
-      client1.wait_for_window(r"^Mumble$")
-      client2.wait_for_window(r"^Mumble$")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_chars("y")
-      client2.send_chars("y")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
+    server.sleep(5)  # wait to get screenshot
+    client1.screenshot("screen1")
+    client2.screenshot("screen2")
 
-      # sometimes the wrong of the 2 windows is focused, we switch focus and try pressing "y" again
-      client1.send_key("alt-tab")
-      client2.send_key("alt-tab")
-      server.sleep(5)  # wait because mumble is slow to register event handlers
-      client1.send_chars("y")
-      client2.send_chars("y")
-
-      # Find clients in logs
-      server.wait_until_succeeds(
-          "journalctl -eu murmur -o cat | grep -q 'client1.\+Authenticated'"
-      )
-      server.wait_until_succeeds(
-          "journalctl -eu murmur -o cat | grep -q 'client2.\+Authenticated'"
-      )
-
-      server.sleep(5)  # wait to get screenshot
-      client1.screenshot("screen1")
-      client2.screenshot("screen2")
-
-      # check if apparmor denied anything
-      server.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
-    '';
-  }
-)
+    # check if apparmor denied anything
+    server.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
+  '';
+}

nixos/tests/mysql/mariadb-galera.nix

@@ -58,30 +58,6 @@ let
                 extraHosts = lib.concatMapStringsSep "\n" (i: "192.168.1.${toString i} galera_0${toString i}") (
                   lib.range 1 6
                 );
-                firewall.allowedTCPPorts = [
-                  3306
-                  4444
-                  4567
-                  4568
-                ];
-                firewall.allowedUDPPorts = [ 4567 ];
-              };
-              systemd.services.mysql = with pkgs; {
-                path = with pkgs; [
-                  bash
-                  gawk
-                  gnutar
-                  gzip
-                  inetutils
-                  iproute2
-                  netcat
-                  procps
-                  pv
-                  rsync
-                  socat
-                  stunnel
-                  which
-                ];
               };
               services.mysql = {
                 enable = true;
@@ -101,27 +77,24 @@ let
                     FLUSH PRIVILEGES;
                   ''
                 );
+
+                galeraCluster = {
+                  enable = true;
+                  package = galeraPackage;
+                  sstMethod = method;
+
+                  localAddress = address;
+                  localName = "galera_0${toString id}";
+
+                  clusterAddress =
+                    "gcomm://"
+                    + lib.optionalString (id == 2 || id == 3) "galera_01,galera_02,galera_03"
+                    + lib.optionalString (id == 5 || id == 6) "galera_04,galera_05,galera_06";
+                };
+
                 settings = {
-                  mysqld = {
-                    bind_address = "0.0.0.0";
-                  };
                   galera = {
-                    wsrep_on = "ON";
                     wsrep_debug = "NONE";
-                    wsrep_retry_autocommit = "3";
-                    wsrep_provider = "${galeraPackage}/lib/galera/libgalera_smm.so";
-                    wsrep_cluster_address =
-                      "gcomm://"
-                      + lib.optionalString (id == 2 || id == 3) "galera_01,galera_02,galera_03"
-                      + lib.optionalString (id == 5 || id == 6) "galera_04,galera_05,galera_06";
-                    wsrep_cluster_name = "galera";
-                    wsrep_node_address = address;
-                    wsrep_node_name = "galera_0${toString id}";
-                    wsrep_sst_method = method;
-                    wsrep_sst_auth = "check_repl:check_pass";
-                    binlog_format = "ROW";
-                    enforce_storage_engine = "InnoDB";
-                    innodb_autoinc_lock_mode = "2";
                   };
                 };
               };

nixos/tests/please.nix

@@ -2,7 +2,7 @@ import ./make-test-python.nix (
   { lib, ... }:
   {
     name = "please";
-    meta.maintainers = with lib.maintainers; [ azahi ];
+    meta.maintainers = [ ];
 
     nodes.machine =
       { ... }:

nixos/tests/taskchampion-sync-server.nix

@@ -6,6 +6,7 @@ import ./make-test-python.nix (
     nodes = {
       server = {
         services.taskchampion-sync-server.enable = true;
+        services.taskchampion-sync-server.host = "0.0.0.0";
         services.taskchampion-sync-server.openFirewall = true;
       };
       client =

nixos/tests/wastebin.nix

@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "wastebin";
+{ lib, ... }:
+{
+  name = "wastebin";
 
-    meta = {
-      maintainers = with lib.maintainers; [ pinpox ];
+  meta = {
+    maintainers = with lib.maintainers; [ pinpox ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.wastebin = {
+        enable = true;
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.wastebin = {
-          enable = true;
-        };
-      };
-
-    testScript = ''
-      machine.wait_for_unit("wastebin.service")
-      machine.wait_for_open_port(8088)
-      machine.succeed("curl --fail http://localhost:8088/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("wastebin.service")
+    machine.wait_for_open_port(8088)
+    machine.succeed("curl --fail http://localhost:8088/")
+  '';
+}

pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix

@@ -30,12 +30,12 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio-unwrapped";
-  version = "5.3.1";
+  version = "5.3.2";
 
   src = fetchurl {
     name = "bitwig-studio-${version}.deb";
     url = "https://www.bitwig.com/dl/Bitwig%20Studio/${version}/installer_linux/";
-    hash = "sha256-mxodFCu4SDzofnoZZZ7TPDUIrRc3UJt8TuEBwDOo2wQ=";
+    hash = "sha256-QKt/myqmoVVffNwkfGcAoknAiZu3D+s7d2lJgtWpvk4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/deadbeef/default.nix

@@ -70,7 +70,7 @@ assert gtk2Support || gtk3Support;
 let
   inherit (lib) optionals;
 
-  version = "1.9.6";
+  version = "1.10.0";
 in
 clangStdenv.mkDerivation {
   pname = "deadbeef";
@@ -81,7 +81,7 @@ clangStdenv.mkDerivation {
     repo = "deadbeef";
     fetchSubmodules = true;
     rev = version;
-    hash = "sha256-Q6hL4fOFPHn26ZqvrebgTMTgQZrhbXCEhM4ZFzNeyJE=";
+    hash = "sha256-qa0ULmE15lV2vkyXPNW9kSISQZEANrjwJwykTiifk5Q=";
   };
 
   buildInputs =

pkgs/applications/audio/qsynth/default.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qsynth";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/qsynth/${pname}-${version}.tar.gz";
-    hash = "sha256-SHMPmZMAlC9L5EAecaZNB0pWnq0heeD8bcbhKeI+YOo=";
+    hash = "sha256-z4l+Ku3oEQV3NunkogyxzaSKhFJuYhIxlExJsACcumY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/youtube-music/default.nix

@@ -13,18 +13,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "youtube-music";
-  version = "3.7.4";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "th-ch";
     repo = "youtube-music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qzvfYxM5mxxujWE0SDUapmN+Px9NkP58e1UeLEtZ7bc=";
+    hash = "sha256-2oXHSYKqftuvPhBogPgl2RxajQZM12ch9ZrEX26wcjs=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-guD1yWFd+uO9H/egHS0PJ9HIIlF+wFS/98YtvjIzZW8=";
+    hash = "sha256-s3Ba7uxtJTDV5tRoLFD30VSL5M/nWHHQZkMc+2bM1wE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/backup/vorta/default.nix

@@ -72,7 +72,7 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   preCheck =
     let

pkgs/applications/blockchains/bitcoin/default.nix

@@ -130,7 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.tests = {

pkgs/applications/editors/android-studio/default.nix

@@ -20,12 +20,12 @@ let
     sha256Hash = "sha256-VNXErfb4PhljcJwGq863ldh/3i8fMdJirlwolEIk+fI=";
   };
   betaVersion = {
-    version = "2024.3.2.9"; # "Android Studio Meerkat Feature Drop | 2024.3.2 Beta 1"
-    sha256Hash = "sha256-yDxDctlZsUmye+XgWwWIHPnrfI3BCj5wYLQG9l8t6mA=";
+    version = "2024.3.2.10"; # "Android Studio Meerkat Feature Drop | 2024.3.2 RC 1"
+    sha256Hash = "sha256-r5YBpACLzfmChY9ORyvDUNl4j8r32dsqj3W7fbSWZU8=";
   };
   latestVersion = {
-    version = "2025.1.1.2"; # "Android Studio Narwhal | 2025.1.1 Canary 2"
-    sha256Hash = "sha256-elWCY/QwBeGIsC4xtQrSV6low5oLH3q1WW2InqQItFM=";
+    version = "2025.1.1.4"; # "Android Studio Narwhal | 2025.1.1 Canary 4"
+    sha256Hash = "sha256-PQe9JEi9Ogoo1hUgPVnCustFgg10v89gTMF7QGi4s1I=";
   };
 in
 {

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -21,15 +21,15 @@
 }:
 
 {
-  name,
+  pname,
   src ? builtins.getAttr stdenv.hostPlatform.system sources,
   sources ? null,
   description,
-  productVersion,
+  version,
 }:
 
 stdenv.mkDerivation rec {
-  inherit name src;
+  inherit pname version src;
 
   desktopItem = makeDesktopItem {
     name = "Eclipse";
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
       } \
       --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${version}/configuration"
 
     # Create desktop item.
     mkdir -p $out/share/applications

pkgs/applications/editors/eclipse/default.nix

@@ -70,9 +70,7 @@ let
   };
   buildEclipse =
     eclipseData:
-    buildEclipseUnversioned (
-      eclipseData // { productVersion = "${platform_major}.${platform_minor}"; }
-    );
+    buildEclipseUnversioned (eclipseData // { version = "${platform_major}.${platform_minor}"; });
 
   generateEclipse =
     id:
@@ -85,7 +83,7 @@ let
       {
         name = "eclipse-${lib.strings.toLower id}";
         value = buildEclipse {
-          name = "eclipse-${lib.strings.toLower id}-${platform_major}.${platform_minor}";
+          pname = "eclipse-${lib.strings.toLower id}";
           inherit description;
           src = fetchurl {
             url =

pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json

@@ -33213,16 +33213,16 @@
   "repo": "sarg/emms-spotify",
   "unstable": {
    "version": [
-    20250322,
-    838
+    20250405,
+    915
    ],
    "deps": [
     "compat",
     "emms",
     "s"
    ],
-   "commit": "e553a2157fb2ebf4e0b00594067eea4c680a1940",
-   "sha256": "0avl3qz8l81mn6wnrvhlky7v50lbrb8s8ip9fsf6cdnf82l172n0"
+   "commit": "dec0d34736da7ff538117033b3758edde3b8e546",
+   "sha256": "1fhffnspnlw75523y5xma5i3wsyjd3h10p0z2h207cdlz1d1bwvv"
   },
   "stable": {
    "version": [

pkgs/applications/editors/rednotebook/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonApplication rec {
   pname = "rednotebook";
-  version = "2.38";
+  version = "2.39";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jendrikseipp";
     repo = "rednotebook";
     tag = "v${version}";
-    sha256 = "sha256-7PUBWJhxE4K9GqAAFGrkelynheuALiDRZXM5acZF7uQ=";
+    sha256 = "sha256-H7Ub4dCJQa4Y3DNBzeIYWlNkpYftezY2MNWokw8ocoA=";
   };
 
   # We have not packaged tests.

pkgs/applications/editors/vim/plugins/generated.nix

@@ -9347,6 +9347,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  neovim-trunk = buildVimPlugin {
+    pname = "neovim-trunk";
+    version = "2024-06-19";
+    src = fetchFromGitHub {
+      owner = "trunk-io";
+      repo = "neovim-trunk";
+      rev = "835180d0cb2db4aa3a934daf65b1a56549018b94";
+      sha256 = "086l7zf2k2p537a13zwivfkamfgpdkrfgq5r23y014s2x2jrh5dw";
+    };
+    meta.homepage = "https://github.com/trunk-io/neovim-trunk/";
+    meta.hydraPlatforms = [ ];
+  };
+
   neoyank-vim = buildVimPlugin {
     pname = "neoyank.vim";
     version = "2020-12-20";

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

@@ -51,7 +51,7 @@ vimUtils.buildVimPlugin {
     substituteInPlace lua/cord/server/fs/init.lua \
       --replace-fail \
         "or M.get_data_path()" \
-        "'${cord-server}'"
+        "or '${cord-server}'"
   '';
 
   passthru = {

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -2153,6 +2153,13 @@ in
     ];
   };
 
+  neovim-trunk = super.neovim-trunk.overrideAttrs {
+    dependencies = with self; [
+      plenary-nvim
+      telescope-nvim
+    ];
+  };
+
   nlsp-settings-nvim = super.nlsp-settings-nvim.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -717,6 +717,7 @@ https://github.com/lawrence-laz/neotest-zig/,HEAD,
 https://github.com/Shatur/neovim-ayu/,,
 https://github.com/cloudhead/neovim-fuzzy/,,
 https://github.com/jeffkreeftmeijer/neovim-sensible/,,
+https://github.com/trunk-io/neovim-trunk/,HEAD,
 https://github.com/Shougo/neoyank.vim/,,
 https://github.com/preservim/nerdcommenter/,,
 https://github.com/preservim/nerdtree/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -90,15 +90,15 @@ let
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
-          version = "4.27.0";
-          hash = "sha256-urXGyHpIDWQ0Bc+8LODC0DcEo6jQ5tA/QptyxCej9yU=";
+          version = "4.33.1";
+          hash = "sha256-iq0UpVaZMOzh4NIRPLk49ciFuO4A6PDSEMe1KKhfSxA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
           description = "Visual Studio Code extension with rich support for the OpenAPI Specification (OAS)";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=42Crunch.vscode-openapi";
           homepage = "https://github.com/42Crunch/vscode-openapi";
-          license = lib.licenses.gpl3;
+          license = lib.licenses.agpl3Only;
           maintainers = [ lib.maintainers.benhiemer ];
         };
       };
@@ -737,8 +737,8 @@ let
         mktplcRef = {
           name = "vscode-intelephense-client";
           publisher = "bmewburn";
-          version = "1.14.3";
-          hash = "sha256-YmrE0HQlqtuFqD3CDuU5SHnvDbZsfZWEIAZLTkiNXtE=";
+          version = "1.14.4";
+          hash = "sha256-WBtaRLAdE2Ttlq4fAS2kI3d0dUAVB+CTdksiSILJ4hY=";
         };
         meta = {
           description = "PHP code intelligence for Visual Studio Code";

pkgs/applications/editors/vscode/vscode.nix

@@ -36,22 +36,22 @@ let
 
   sha256 =
     {
-      x86_64-linux = "0pmjpjjafq36dr5dlf64bbkr6p697d2yc1z7l876i0vnw10g6731";
-      x86_64-darwin = "1y32szp9asmchl64wfwz4jvhkr4441aykvy64qc8f4y51wxxxcnv";
-      aarch64-linux = "0zbgbhnlg7wcgz8v34rknvblmdrac0l7qy5qfp2rn7jcdrm5qa53";
-      aarch64-darwin = "00y6rz2cfz193n3svvsdknk6g38vg1w92yiqk5n14lyv2g8av2dc";
-      armv7l-linux = "19q4rip33ma7krwpymp396ip5kwd5g8hp2n6jqcmljv59lw10c9h";
+      x86_64-linux = "1fds83amgkzp9nz7cvs432ilr602lr45h916vkq8qhpbb84ildd2";
+      x86_64-darwin = "1pmda39jz05d0g3k6rgavhwmgxkldmarbj59fd9i0b5dcspzybxf";
+      aarch64-linux = "148cpbhz14aldqklnma9mpakylkx2qk86k5ppij0zlqb5m6mgnaz";
+      aarch64-darwin = "10v37bcl8wg4j5snd7n3l7zwqf51vkx4cs2abf33ysazmafvnfpd";
+      armv7l-linux = "10vfnk87g4agwp0phh7l9k7hg727n1l4fcvqn1bxbrix9hbq7bbc";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.98.2";
+  version = "1.99.0";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "ddc367ed5c8936efe395cffeec279b04ffd7db78";
+  rev = "4437686ffebaf200fa4a6e6e67f735f3edf24ada";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "19dc6smiyi8qv79gr95wgx2fjzfjkrv4x3zfvdskms4bw1kn6xck";
+      sha256 = "11705fdsb7hc25awkiknjc7pb93x2w74yxkf3351c6n2sf3i2755";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/emulators/mame/default.nix

@@ -194,7 +194,7 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = [ "-h" ];
+  versionCheckProgramArg = "-h";
 
   passthru.updateScript = writeScript "mame-update-script" ''
     #!/usr/bin/env nix-shell

pkgs/applications/graphics/seamly2d/default.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "seamly2d";
-  version = "2025.3.17.207";
+  version = "2025.3.25.1924";
 
   src = fetchFromGitHub {
     owner = "FashionFreedom";
     repo = "Seamly2D";
     tag = "v${version}";
-    hash = "sha256-5Bi+SycUZFOxmP0bWbqSnKRZ+UW6b48Cn4YUVfHi4Js=";
+    hash = "sha256-hBXdf/r3hXSjy6Vp5SjfOcefxj/aP0La4LTiyOESzmQ=";
   };
 
   buildInputs = [

pkgs/applications/misc/bikeshed/default.nix

@@ -38,12 +38,12 @@
 
 buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.1.1";
+  version = "5.1.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ck3Ucv39w+EL1r+IzMbnqVfBqtqBVq4kxdpZVDWpM3U=";
+    hash = "sha256-QIADVcxgJreH2pvXRVIBE5p6nEEYZtTiSo00RrpFT+E=";
   };
 
   build-system = [ setuptools ];

pkgs/applications/misc/cambrinary/default.nix

@@ -36,6 +36,6 @@ buildPythonApplication {
     homepage = "https://github.com/xueyuanl/cambrinary";
     license = licenses.gpl3Only;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ azahi ];
+    maintainers = [ ];
   };
 }

pkgs/applications/misc/devilspie2/default.nix

@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   version = "0.44";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/devilspie2/devilspie2-${version}.tar.xz";
-    sha256 = "Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/protonup-qt/default.nix

@@ -5,10 +5,10 @@
 }:
 let
   pname = "protonup-qt";
-  version = "2.11.1";
+  version = "2.12.0";
   src = fetchurl {
     url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-    hash = "sha256-xHkeAqveXF8YLFvKHTZtSvINIIoiqhNbwVuKfnaHcQI=";
+    hash = "sha256-8MeHSy3XW1oXAD2xrDSIB0ZLJxtk5UBIMpDRTPF9ksU=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in

pkgs/applications/misc/xca/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xca";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "chris2511";
     repo = "xca";
     rev = "RELEASE.${finalAttrs.version}";
-    hash = "sha256-2TqqHTutG+5YU2mJNTS3pvtEqV7qKVB+j/dipdmEkIk=";
+    hash = "sha256-28K6luMuYcDuNKd/aQG9HX9VN5YkKArl/GQn5spQ+Sg=";
   };
 
   buildInputs = [

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -49,7 +49,7 @@ let
       wmClass ? applicationName,
       nativeMessagingHosts ? [ ],
       pkcs11Modules ? [ ],
-      useGlvnd ? true,
+      useGlvnd ? (!isDarwin),
       cfg ? config.${applicationName} or { },
 
       ## Following options are needed for extra prefs & policies
@@ -109,13 +109,13 @@ let
             zlib
           ]
         )
-        ++ lib.optional (config.pulseaudio or true) libpulseaudio
+        ++ lib.optional (config.pulseaudio or (!isDarwin)) libpulseaudio
         ++ lib.optional alsaSupport alsa-lib
         ++ lib.optional sndioSupport sndio
         ++ lib.optional jackSupport libjack2
         ++ lib.optional smartcardSupport opensc
         ++ pkcs11Modules
-        ++ gtk_modules;
+        ++ lib.optionals (!isDarwin) gtk_modules;
       gtk_modules = [ libcanberra-gtk3 ];
 
       # Darwin does not rename bundled binaries
@@ -289,7 +289,7 @@ let
         lndir
         jq
       ];
-      buildInputs = [ browser.gtk3 ];
+      buildInputs = lib.optionals (!isDarwin) [ browser.gtk3 ];
 
       makeWrapperArgs =
         [
@@ -298,11 +298,6 @@ let
           ":"
           "${finalAttrs.libs}"
 
-          "--suffix"
-          "GTK_PATH"
-          ":"
-          "${lib.concatStringsSep ":" finalAttrs.gtk_modules}"
-
           "--suffix"
           "PATH"
           ":"
@@ -319,6 +314,12 @@ let
           "--set"
           "MOZ_ALLOW_DOWNGRADE"
           "1"
+        ]
+        ++ lib.optionals (!isDarwin) [
+          "--suffix"
+          "GTK_PATH"
+          ":"
+          "${lib.concatStringsSep ":" finalAttrs.gtk_modules}"
 
           "--suffix"
           "XDG_DATA_DIRS"
@@ -330,7 +331,7 @@ let
           "1"
 
         ]
-        ++ lib.optionals (!xdg-utils.meta.broken) [
+        ++ lib.optionals (!xdg-utils.meta.broken && !isDarwin) [
           # make xdg-open overridable at runtime
           "--suffix"
           "PATH"
@@ -457,8 +458,11 @@ let
             oldExe="$executablePrefix/.${applicationName}"-old
             mv "$executablePath" "$oldExe"
           fi
-
+        ''
+        + lib.optionalString (!isDarwin) ''
           appendToVar makeWrapperArgs --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
+        ''
+        + ''
           concatTo makeWrapperArgs oldWrapperArgs
 
           makeWrapper "$oldExe" "$out/${finalBinaryPath}" "''${makeWrapperArgs[@]}"

pkgs/applications/networking/cloudflared/default.nix

@@ -7,31 +7,15 @@
   gitUpdater,
 }:
 
-let
-  # https://github.com/cloudflare/cloudflared/issues/1151#issuecomment-1888819250
-  # buildGoModule = buildGoModule.override {
-  #   go = buildPackages.go_1_22.overrideAttrs {
-  #     pname = "cloudflare-go";
-  #     version = "1.22.2-devel-cf";
-  #     src = fetchFromGitHub {
-  #       owner = "cloudflare";
-  #       repo = "go";
-  #       rev = "ec0a014545f180b0c74dfd687698657a9e86e310";
-  #       sha256 = "sha256-oQQ9Jyh8TphZSCaHqaugTL7v0aeZjyOdVACz86I2KvU=";
-  #     };
-  #   };
-  # };
-in
-
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2025.2.1";
+  version = "2025.4.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = version;
-    hash = "sha256-RiHEUs1I9ErYBQF28la6kqU3BW968PVT+K7uGUVr6Ec=";
+    hash = "sha256-PKF7wP/ueLLhV8k3nMUm/c5fkg+7CwRf1oLnx0qbcA0=";
   };
 
   vendorHash = null;
@@ -105,10 +89,8 @@ buildGoModule rec {
       thoughtpolice
       piperswe
       qjoly
+      wrbbz
     ];
     mainProgram = "cloudflared";
-    # cloudflared requires a fork of go 1.22 to build (see override above),
-    # but go 1.22 is EOL and the toolchain has been removed from nixpkgs.
-    broken = true;
   };
 }

pkgs/applications/networking/cluster/calico/default.nix

@@ -14,16 +14,16 @@ builtins.mapAttrs
     }:
     buildGoModule rec {
       inherit pname;
-      version = "3.29.1";
+      version = "3.29.3";
 
       src = fetchFromGitHub {
         owner = "projectcalico";
         repo = "calico";
         rev = "v${version}";
-        hash = "sha256-e/xyrFJ9t+awpU8u8uYmXFRnk92/06vI5OoClyAMKTU=";
+        hash = "sha256-JK/iKVLXT8h+xZpkjVBEI8vfgRuoTHwWaoKikjBsJgI=";
       };
 
-      vendorHash = "sha256-OP3J2NE491Aivzo80OmLAyQGe3hixLTz0p9FSA897ao=";
+      vendorHash = "sha256-dkBOhuX/tf+emLLeZ+7fI+z1pKwZLD0ZqZNxUMS32NE=";
 
       inherit doCheck subPackages;
 

pkgs/applications/networking/cluster/helm/plugins/helm-cm-push.nix

@@ -43,6 +43,6 @@ buildGoModule rec {
     description = "Helm plugin to push chart package to ChartMuseum";
     homepage = "https://github.com/chartmuseum/helm-push";
     license = licenses.asl20;
-    maintainers = with maintainers; [ azahi ];
+    maintainers = [ ];
   };
 }

pkgs/applications/networking/cluster/linkerd/edge.nix

@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "25.3.2";
-  sha256 = "1l0sww0h3s1x9262rj801jk965p1c8bl92lns53yhkarv80cy03y";
-  vendorHash = "sha256-9b98kz4jlkL6S4g/naOIiSazjo8twkk+PL4aXSWubfQ=";
+  version = "25.4.1";
+  sha256 = "18hv0lfh1ldy7chjs2ssn62crn71a0mvvn1g8b35l91g8mqyh4ry";
+  vendorHash = "sha256-vKehadl94okOd1YfaETgdQwWr8F2gOPGyjzzTjxKyLA=";
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -171,13 +171,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-cHuBfF0R/n03Y5KNnbdsWcGeX24+NPT2HnsQpTivCf0=",
+    "hash": "sha256-UQbF6erjW3nGlgsDr2OFhHmyDyFGpjAfgQx91Mke1cE=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.45.1",
+    "rev": "v2.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iNY6Jz/SKOLynx33smDFbg371Wa31CouNtrOuV7lkcw="
+    "vendorHash": "sha256-XD7xvp8P9zaDJ5J07+cc+mFZA3F1JQDvK+1Tgqb6k/o="
   },
   "bitwarden": {
     "hash": "sha256-fUmwIfRiLpbhENPZwc9CWZsIugppfc68qGR1Iy1UyBE=",
@@ -317,13 +317,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-nevuczChWR4HPDefChJnSAVI53TFuPFdyDwKsHM3SW8=",
+    "hash": "sha256-7V4nSuksCvy2fSyQbzVo0RlEaevUwCIlX61y3GEBqVk=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.58.0",
+    "rev": "v3.59.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tf0lVgueRNVXfttzrCyy0TSiQAVGcWIUCoDLyOWfW7s="
+    "vendorHash": "sha256-vOg972dcpX9MEZ/GaPGcm0OIC1xu+p6KMcflEUPx0hU="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -516,13 +516,13 @@
     "vendorHash": "sha256-oGO+++WMiXUTCLFdBH2/uAzdN3RtrSNDSUBVMIYmI14="
   },
   "google-beta": {
-    "hash": "sha256-FybWpnUBQCxY1XQNSCk4slUg6vF8XDW1uQwgF0a2PgQ=",
+    "hash": "sha256-XocoPOGErjT2UMoJZA4Tpeq5lzLSXV9SWud+/zFSpfc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.26.0",
+    "rev": "v6.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AQKukbsW+EYndMxUpUHIWPh3taaJINs6qY9xhkP/N54="
+    "vendorHash": "sha256-6dmNe/Ky+FACzDSjp3SCv4N4783K3CszhQ6eXRQ5qzM="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -534,13 +534,13 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-A6rCZbnLSbPHn+QQ5wMlINRqT04tEvil2rHkdr5iBQw=",
+    "hash": "sha256-uWRFi0jYGwlZ1b8qvVoL/NslI6e5bv76QmlWL5C7fA8=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v3.22.0",
+    "rev": "v3.22.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GFH2w4bdqYWl0eFBo1r6YL1pA0l5QMwrXQ9BvK3DmEI="
+    "vendorHash": "sha256-wqGNczKE2IFq/wLb8fj5+k07Vh1dR1oXwW06fIWV6Eg="
   },
   "gridscale": {
     "hash": "sha256-Ygt3L/dzwycccQZmuwbcaLHp9FBGNHgU19wSNmY8PzQ=",
@@ -615,11 +615,11 @@
     "vendorHash": "sha256-GoOKTT+EOhaPhpbgSW3SycYsE8LEQP0v4eQfiTEnPy8="
   },
   "huaweicloud": {
-    "hash": "sha256-VSnjbjfE551IfZNsJh24pye3MaznTB1GQlmbM4IsJK4=",
+    "hash": "sha256-kwtQQOVIJy03tW2tRURN0NhYW5MT8O65nRdydnkipx0=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.73.3",
+    "rev": "v1.73.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -750,13 +750,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "linode": {
-    "hash": "sha256-ExAB9/27gdDP7SV5UXAaVO/aJ2LYtZYPr9Ur1ftxdCc=",
+    "hash": "sha256-7CGut0z0NEu4yeJOCbqgL9CH7uDwGQbUKTnPK62Xbp0=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v2.35.1",
+    "rev": "v2.36.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WRM/2mtu/U4Tgxc3nhptNRbscS9uhqa9v66nY2QXXig="
+    "vendorHash": "sha256-nrZNJZHb1FJ7csM/C3mR+RUYy/2TeUzQ1sDmQ8Q4F/s="
   },
   "linuxbox": {
     "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
@@ -813,13 +813,13 @@
     "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
   },
   "migadu": {
-    "hash": "sha256-80ke9CIl7kBUF3JRgydikXow2G3XhSVX8EZK7sd8xzA=",
+    "hash": "sha256-Bt4hy8GwEMAmNP8l8kvTxXV48EfJq4SPzihXL44JHSU=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.3.20",
+    "rev": "2025.4.3",
     "spdx": "0BSD",
-    "vendorHash": "sha256-xORnddTfzbQ1ZwINLF2/Fwi/rJ1KyxPzBKfNkQKNg0w="
+    "vendorHash": "sha256-pKUgvL46lY9K2GBCYpQKkmudCQKhCViAXniMWtrSxbc="
   },
   "minio": {
     "hash": "sha256-OIdXZIy+W8yO3y7z/1JzG7QegJmMLTFSoC7FmioscmA=",
@@ -831,13 +831,13 @@
     "vendorHash": "sha256-1nm2Y4T9/mCWMXMjXEzBz3w08AYHjQJeb9mYPQeWPs0="
   },
   "mongodbatlas": {
-    "hash": "sha256-nuamsevz6ME0WlnnWGFKkLiD5wrihq1EML68rvRiu7Q=",
+    "hash": "sha256-hsm5a6rHVy/m+nc77vwogQx4xnerwpkYKQF9FagbK9c=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.29.0",
+    "rev": "v1.31.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WMExn+d3G0zpATJ2LYaJ9R4SDpQbngQE2YW3p8x3Scc="
+    "vendorHash": "sha256-ml6bduGjFy6cN4zwMMQnw6Ie73Ucx3H1en7viQksGBk="
   },
   "namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@@ -885,13 +885,13 @@
     "vendorHash": "sha256-YmZvHzrEZVvXI8CIcjX40s+MHTThPeXNQ05cnqkNbbE="
   },
   "ns1": {
-    "hash": "sha256-llJmz8QWwoApmhWEXlQMlVvteXSlkZhXh7tCWuMMbrc=",
+    "hash": "sha256-KvslOHWMEYFFrVCF2AOH3x2ENtoZeZQ+WC3ZvXiEcEc=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.5.3",
+    "rev": "v2.6.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jZAwCXozHYReks6ZGjqkvIitWeg19AVGm3R9r20XsMM="
+    "vendorHash": "sha256-1qFfXwlLRIAKUswrTeLtWVsZmOE/LfXrfnW8MgM8JaU="
   },
   "null": {
     "hash": "sha256-zvzBWnxWVXNOebnlgaP8lzwk6DMwwkGxx4i1QKCLSz0=",
@@ -967,13 +967,13 @@
     "vendorHash": "sha256-0Atbzx1DjInPMa1lNxyNKfNMILjN4S814TlIAQeTfdI="
   },
   "opentelekomcloud": {
-    "hash": "sha256-+ngMqXN5jrHTNZm0BJWppUzD/i6r6UznY8YsA26SdY4=",
+    "hash": "sha256-Wn5KjmQMIHeP99jXh+7ZVfj/DD6fZEZFHdQ0kAKa0yk=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.33",
+    "rev": "v1.36.34",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-v0Jr7yh2DCA89UxxOUU7sC7jQ1myv70T3+DjBPpz5pE="
+    "vendorHash": "sha256-hpMwKy+DfwM9dPojYO5kKz7RF5mWagxwh5Gl8lefXSc="
   },
   "openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -1102,11 +1102,11 @@
     "vendorHash": "sha256-lkooWo0DbpL4zjNQ20TRw+hsHXWZP9u7u95n1WyzTQk="
   },
   "rootly": {
-    "hash": "sha256-KAeTOvh67bEpLVV/9jr1GI78wTA3Wu6zl69GlLKkPaA=",
+    "hash": "sha256-9D4dOPJAmSdKhJ3TLhQVHsmGxKoD7oiIDBgltCjxl6I=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v2.24.2",
+    "rev": "v2.26.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-iq/Skuegzn9bz7aF6COYeoXQpXmKDkvKJJ/fnJqyJFg="
   },
@@ -1156,13 +1156,13 @@
     "vendorHash": "sha256-kCVJEIR+3DAOoDzqv1Dd2JUPmEpO3sGHcjbEbMZT4BM="
   },
   "sentry": {
-    "hash": "sha256-2JfzteVripOz96bAtQXC32wi8dWUQw8bry0HllNRQRA=",
+    "hash": "sha256-6GcO+r8Mp6cX33akQ8igjueJPlIXMYASiRlQrqfG4o8=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.14.3",
+    "rev": "v0.14.4",
     "spdx": "MIT",
-    "vendorHash": "sha256-RbUBHX0/nUihgiK6ibbkR/2DKJOdJt9VYyCJgWsj2zo="
+    "vendorHash": "sha256-eBqhJY02JDZmtP8ccbcg5ZAJRejiDNr3cI/eBhbBNwE="
   },
   "shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",

pkgs/applications/networking/discordo/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "0-unstable-2025-03-19";
+  version = "0-unstable-2025-03-31";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "aa58ee2a8a177f01d39bde7368f017fe0fcf425a";
-    hash = "sha256-H+m5HqHGC1DzWgTQ0cyD5uwGLiRrKU3eJZ5M/InNmBg=";
+    rev = "9e95b18ab7ba021a71f94e7520c1b9e3b73d3c0f";
+    hash = "sha256-XxjhLVs87npwuys5FmfMba6dg4NcgRPIieTDgI6UXyk=";
   };
 
-  vendorHash = "sha256-tKY/8JUWNnHXtl305k/azAVsVihjC7TBYpopf/Ocqac=";
+  vendorHash = "sha256-NKGsY/5FqLGbwyW6fVSxictDVhju0+jOJSBXQp3ZhFY=";
 
   env.CGO_ENABLED = 0;
 

pkgs/applications/networking/feedreaders/tuifeed/default.nix

@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tuifeed";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-/13YC5ur633bCRq2pEQKWL+EwLFp5ZkJF6Pnipqo76s=";
+    hash = "sha256-CL6cd9OfvnA5N4W3rGl7XLcnlSrh3kcqA7idxexkjA4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xfva1kEJz/KjPB5YP11130pyQngYUWAyqH3dVU7WqI8=";
+  cargoHash = "sha256-A7kD46gfXWK/OlFVMULlMa7Z9Q1it9/rhGo6pjFa38k=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 

pkgs/applications/networking/mullvad/mullvad.nix

@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/applications/networking/sync/rclone/default.nix

@@ -90,7 +90,7 @@ buildGoModule rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
-  versionCheckProgramArg = [ "version" ];
+  versionCheckProgramArg = "version";
 
   passthru = {
     tests = {

pkgs/applications/radio/klog/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "1.3.2";
 
   src = fetchurl {
-    url = "https://download.savannah.nongnu.org/releases/klog/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     sha256 = "1d5x7rq0mgfrqws3q1y4z8wh2qa3gvsmd0ssf2yqgkyq3fhdrb5c";
   };
 

pkgs/applications/video/anilibria-winmaclinux/default.nix

@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.25";
+  version = "2.2.26";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-9jlGENJVgzQi5oEspM6JHIgYt9np8WNKPJzoW2kSgQs=";
+    hash = "sha256-F+5R1nSmZuHKUe9bAEVwOru07SVs8tIQlbDC6Ip+zy4=";
   };
 
   sourceRoot = "${src.name}/src";

pkgs/applications/video/jellyfin-mpv-shim/default.nix

@@ -19,11 +19,11 @@
 
 buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EANaNmvD8hcdGB2aoGemKvA9syS1VvIqGsP1jk0b+lE=";
+    hash = "sha256-YrwMvP66LAWKgx/yWBkWIkZtJ4a0YnhCiL7xB6fGm0E=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/kodi/addons/inputstream-ffmpegdirect/default.nix

@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
   pname = "inputstream-ffmpegdirect";
   namespace = "inputstream.ffmpegdirect";
-  version = "21.3.5";
+  version = "21.3.7";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.ffmpegdirect";
     rev = "${version}-${rel}";
-    sha256 = "sha256-pPufkDPHq5EsvC6YTsRX9TjqjIczOL/6Vc5HGDIe9Gk=";
+    sha256 = "sha256-s1Owbj95DT+RR8eBRwMuUHrJwr6JR05efx5M11vH8cQ=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix

@@ -11,13 +11,13 @@
 buildKodiBinaryAddon rec {
   pname = "inputstream-rtmp";
   namespace = "inputstream.rtmp";
-  version = "21.1.0";
+  version = "21.1.2";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.rtmp";
     rev = "${version}-${rel}";
-    sha256 = "sha256-M6LFokWQRzBZ7inzRsMxyWzkV0XsGHh4d0CPhv1NCfI=";
+    sha256 = "sha256-AkpRbYOe30dWDcflCGXxJz8Y+9bQw9ZmZF88ra2c+fc=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/pvr-hts/default.nix

@@ -7,13 +7,13 @@
 buildKodiBinaryAddon rec {
   pname = "pvr-hts";
   namespace = "pvr.hts";
-  version = "21.2.5";
+  version = "21.2.6";
 
   src = fetchFromGitHub {
     owner = "kodi-pvr";
     repo = "pvr.hts";
     rev = "${version}-${rel}";
-    sha256 = "sha256-BG5mGD674gvjUSdydu4g3F/4GH53gkJoKMDuvaFNi6k=";
+    sha256 = "sha256-opxNgin+Sz/Nb9IGZ+OFrCzbDc4FXl2LaNKUu5LAgFM=";
   };
 
   meta = with lib; {

pkgs/applications/video/kodi/addons/pvr-iptvsimple/default.nix

@@ -14,13 +14,13 @@
 buildKodiBinaryAddon rec {
   pname = "pvr-iptvsimple";
   namespace = "pvr.iptvsimple";
-  version = "21.8.5";
+  version = "21.10.2";
 
   src = fetchFromGitHub {
     owner = "kodi-pvr";
     repo = "pvr.iptvsimple";
     rev = "${version}-${rel}";
-    sha256 = "sha256-UFEZZr7Z6GqnN8ZSA+JkdsiAlf7p5xPwDOcwLzJc9v8=";
+    sha256 = "sha256-bw0rAEn8R44n5Nzc9ni6IGaG/Bxry6GSyWcT6BdgLz8=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/kodi/addons/pvr-vdr-vnsi/default.nix

@@ -8,13 +8,13 @@
 buildKodiBinaryAddon rec {
   pname = "pvr-vdr-vnsi";
   namespace = "pvr.vdr.vnsi";
-  version = "21.1.2";
+  version = "21.1.3";
 
   src = fetchFromGitHub {
     owner = "kodi-pvr";
     repo = "pvr.vdr.vnsi";
     rev = "${version}-${rel}";
-    sha256 = "sha256-o7WVO/TvSK6bZEnUeNQhapXOVQbDlpJDObC93/9XpJo=";
+    sha256 = "sha256-V/ICEK006Zs4mipywAbRl8ZdezsprCgdC2WYtc/cAAY=";
   };
 
   extraBuildInputs = [ libGL ];

pkgs/applications/video/obs-studio/plugins/obs-color-monitor.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-color-monitor";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "norihiro";
     repo = "obs-color-monitor";
     tag = finalAttrs.version;
-    hash = "sha256-cVMpmkcw8GzNGyd80g1oKmyiEYGMcRtWtDj9MC7RYf8=";
+    hash = "sha256-EIp1GQ5dKN43D7xodX/ucYcJm994eKsnidFlbLKWHuI=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -39,6 +39,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ hlad ];
-    broken = true;
   };
 })

pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py

@@ -60,7 +60,7 @@ for pname in depsDict:
         command = ["nix-prefetch-git", strippedRepo, version]
         rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
         sha256 = json.loads(rawRes)["sha256"]
-        lockedDepsDict[pname] = {"version": version, "repository": repository, "sha256": sha256}
+        lockedDepsDict[pname] = {"version": version, "repository": strippedRepo, "sha256": sha256}
     else:
         eprint(f"Fetching {pname}@{version}")
         url = f"https://code.dlang.org/packages/{pname}/{version}.zip"

pkgs/build-support/fetchurl/mirrors.nix

@@ -215,13 +215,19 @@
 
   # SAMBA
   samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
+    "https://download.samba.org/pub/"
+    "http://download.samba.org/pub/"
   ];
 
   # GNU Savannah
   savannah = [
-    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
+    # Try the official HTTP(S) dispatchers first.
+    # These generate redirects to mirrors appropriate for the user.
+    "https://download.savannah.gnu.org/releases/"
+    "https://download.savannah.nongnu.org/releases/"
+
+    # If the above fail, try some individual mirrors.
+    # These are taken from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
     "https://mirror.easyname.at/nongnu/"
     "https://savannah.c3sl.ufpr.br/"
     "https://mirror.csclub.uwaterloo.ca/nongnu/"

pkgs/by-name/_0/_010editor/package.nix

@@ -13,18 +13,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "010editor";
-  version = "15.0.1";
+  version = "15.0.2";
 
   src =
     if stdenv.hostPlatform.isLinux then
       fetchzip {
         url = "https://download.sweetscape.com/010EditorLinux64Installer${finalAttrs.version}.tar.gz";
-        hash = "sha256-/Bfm/fPX3Szla23U9+qoq99E2v8jC3f9pgkJMTxNFUk=";
+        hash = "sha256-oXwC4criDox8rac7mnJroqxMNKU7k+y7JQqc88XoRFc=";
       }
     else
       fetchurl {
         url = "https://download.sweetscape.com/010EditorMac64Installer${finalAttrs.version}.dmg";
-        hash = "sha256-hpDhcX1xS4Nry2HOIrFwqYK45JOmy66lPq6dJr9pkQg=";
+        hash = "sha256-RZtFV3AbE5KfzW18usW0FS/AnX8Uets/RkVayBAODQ4=";
       };
 
   sourceRoot = ".";

pkgs/by-name/_1/_1password-cli/package.nix

@@ -80,7 +80,7 @@ stdenv.mkDerivation {
   doInstallCheck = true;
 
   versionCheckProgram = "${builtins.placeholder "out"}/bin/${mainProgram}";
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   passthru = {
     updateScript = ./update.sh;

pkgs/by-name/ab/abseil-cpp_202501/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gtest,
+  static ? stdenv.hostPlatform.isStatic,
+  cxxStandard ? null,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "abseil-cpp";
+  version = "20250127.1";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    tag = finalAttrs.version;
+    hash = "sha256-QTywqQCkyGFpdbtDBvUwz9bGXxbJs/qoFKF6zYAZUmQ=";
+  };
+
+  cmakeFlags =
+    [
+      (lib.cmakeBool "ABSL_BUILD_TEST_HELPERS" true)
+      (lib.cmakeBool "ABSL_USE_EXTERNAL_GOOGLETEST" true)
+      (lib.cmakeBool "BUILD_SHARED_LIBS" (!static))
+    ]
+    ++ lib.optionals (cxxStandard != null) [
+      (lib.cmakeFeature "CMAKE_CXX_STANDARD" cxxStandard)
+    ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ gtest ];
+
+  meta = {
+    description = "Open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    changelog = "https://github.com/abseil/abseil-cpp/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.GaetanLepage ];
+  };
+})

pkgs/by-name/ac/act/package.nix

@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.2.75";
+  version = "0.2.76";
 in
 buildGoModule {
   pname = "act";
@@ -18,10 +18,10 @@ buildGoModule {
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-YIhgS1kQ9EKoIaSp/zGVQmWXyYZranEQU9onQW3gD0k=";
+    hash = "sha256-9Pn4Yzc0ZjOJy0ktJl/C1OXHkJ4vZrA0d4FJTooLvWU=";
   };
 
-  vendorHash = "sha256-LKNajCwb33syv9KcNHKYIGTnAN8r7PkGilDB3HnKkY4=";
+  vendorHash = "sha256-ak7JFh739SoHeiEWLjthqAn1KHamGujYJNa3ZIdhLLQ=";
 
   doCheck = false;
 

pkgs/by-name/ad/adidnsdump/package.nix

@@ -6,33 +6,29 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "adidnsdump";
-  version = "1.3.1-unstable-2023-12-13";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dirkjanm";
     repo = "adidnsdump";
-    rev = "8bbb4b05b2d1b792f3c77ce0a4a762ab9e08727d";
-    hash = "sha256-dIbnUyV3gdWHHoyzD0ME2fXlMoiQkdrqQ7qQ6Ab6qs0=";
+    tag = "v${version}";
+    hash = "sha256-gKOIZuXYm8ltaajmOZXulPX5dI4fWz4xiZ8W0kPpcRk=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     impacket
     ldap3
   ];
 
-  pythonImportsCheck = [
-    "adidnsdump"
-  ];
+  pythonImportsCheck = [ "adidnsdump" ];
 
   meta = with lib; {
     description = "Active Directory Integrated DNS dumping by any authenticated user";
     homepage = "https://github.com/dirkjanm/adidnsdump";
-    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/v${version}";
+    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "adidnsdump";

pkgs/by-name/ad/adw-gtk3/package.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adw-gtk3";
-  version = "5.6";
+  version = "5.7";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = "adw-gtk3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S/H6JGXwEgiqmcH1W+ZyHYOkk0gQtKG9Q3BiI2IjnEM=";
+    hash = "sha256-10NxXNbKQt39c5R+mgcvzjyZO7Z/lcVi+vArH+K35k8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ai/aichat/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aichat";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "aichat";
     tag = "v${version}";
-    hash = "sha256-gs2nkZhz26tmFbAShLsFOgYt/RlPiqKTmdaPSG96m3E=";
+    hash = "sha256-5fXZfRrHBAtjUa1VzzsdoFvXQSPQ8YUNJ7yhZlp58tM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cDYxT8WvryTLzBeMtp/iObdSfF84W1XT8ZN/nmoZfFY=";
+  cargoHash = "sha256-YK2mps9DUs4HNFmYHtZHTJREuImlQ24y64ykGr8ovTs=";
 
   nativeBuildInputs = [
     pkg-config
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/ai/aide/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "aide";
-  version = "0.18.8";
+  version = "0.19";
 
   src = fetchurl {
     url = "https://github.com/aide/aide/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-FmYtxjLRfixWMLgBdS+XkSqOIml8Bl694XXxzDe4OmA=";
+    sha256 = "sha256-5/ugIUvgEpnXY1m/8pdSM+0kEzLkz8//Wc0baomrpeQ=";
   };
 
   buildInputs = [

pkgs/by-name/ai/air-formatter/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
   versionCheckProgram = "${placeholder "out"}/bin/air";
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/ai/aixlog/package.nix

@@ -32,6 +32,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/badaix/aixlog";
     changelog = "https://github.com/badaix/aixlog/releases/tag/${src.rev}";
     license = licenses.mit;
-    maintainers = with maintainers; [ azahi ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/al/alpaca/package.nix

@@ -20,14 +20,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "alpaca";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Jeffser";
     repo = "Alpaca";
     tag = version;
-    hash = "sha256-uUGsdHrqzA5fZ4LNtX04H4ue9n4JQrkTYW2PCCFYFHc=";
+    hash = "sha256-dp/v5PZoDqSp2h0gtZk97ImDKO201VZMiCBv2XnqoGQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/al/altus/package.nix

@@ -7,12 +7,12 @@
 
 let
   pname = "altus";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchurl {
     name = "altus-${version}.AppImage";
     url = "https://github.com/amanharwara/altus/releases/download/${version}/Altus-${version}.AppImage";
-    hash = "sha512-u4eBTboFJaU5qLFURXFchOmFV7GzlDbUokrBpxx8QeAJO6B0IwX1gJU0C69BKinIdO4Q93SAcjsvUkvSI+blrw==";
+    hash = "sha512-wkH9ZEmEJTP8PAPBG4QeewGrR2Nmd4p2ZWTP/il4+bHREz0N8GttUwkjhYOy1heRSV/S+zlkGjfB8VTaNjGaaA==";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/am/amazon-cloudwatch-agent/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300053.1";
+  version = "1.300054.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     tag = "v${version}";
-    hash = "sha256-UyaAFBJ/GRwfnZVfFDsRSjAbMEHoiVCpo/M6c7nzA5M=";
+    hash = "sha256-DakLgM3vNHHzOlQTVMGwIioPhB3YryEcm7T0xepAJu4=";
   };
 
-  vendorHash = "sha256-MrT30LZODuvzq3hqk/6D5u0ZAf2q2WB07yfjl6RbmtM=";
+  vendorHash = "sha256-rw+doSJGeFl72hHA8FSL3H61KiYwatabQ7jEMOfJZ60=";
 
   # See the list in https://github.com/aws/amazon-cloudwatch-agent/blob/v1.300049.1/Makefile#L68-L77.
   subPackages = [

pkgs/by-name/an/ansel/package.nix

@@ -78,13 +78,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "dd6127b7324f012abbdda55a56af4bcd061f0f83";
-    hash = "sha256-RNYs40UcfLlkqdf8vRjAzGDYvIMjxTNdamc9kt0Eg1I=";
+    rev = "62f9a4c56b02deca9fda4aff4392e4f44dea379c";
+    hash = "sha256-T9go14/wMJbOzKjOnRzzmeklFPQMbrTUnXyPlVahpkQ=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/anubis/package.nix

@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "anubis";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "TecharoHQ";
     repo = "anubis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PlZEGe3kTBkTd17nTLSW6pGiUKIPVQttep92FT+10g8=";
+    hash = "sha256-5OqpmuRTrM+hseIhR2sTb+K01Co6X+Rhb6mN+U54NAI=";
   };
 
   vendorHash = "sha256-Rcra5cu7zxGm2LhL2x9Kd3j/uQaEb8OOh/j5Rhh8S1k=";

pkgs/by-name/ar/argo-rollouts/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "argo-rollouts";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-rollouts";
     rev = "v${version}";
-    sha256 = "sha256-SNzWAs1ytduU2XhPccJ+HUagh8cHcIb6zj0/EosdpTc=";
+    sha256 = "sha256-C2Ha3Sdq5IOHEc9S4jb4g6do6a4Gkm4E0BVFq5TnJDM=";
   };
 
   vendorHash = "sha256-1YtRc2xLP8QAIK+vO690zHb9tXCkR7na/zwwlIdAxgQ=";

pkgs/by-name/ar/arti/package.nix

@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {

pkgs/by-name/as/ast-grep/package.nix

@@ -56,7 +56,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/av/avbroot/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-d0sYOTM9o100XJ+5WzjSGM41Ax+l6LHlM0/Lbwz8gVc=";
+    hash = "sha256-OICx08MiiiocqVB61fMiUSmG7QOpsrLfPkLuDktTXt0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-LrjzDser5J7fIfviAGxeCmaoeu4XV/aG54ptiVI3Mn4=";
+  cargoHash = "sha256-iZUGFzg+x4aPL8AoPYVugjrB5ZSrmaCRWMcEovlcPx4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/av/avro-cpp/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/avrogencpp";
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "C++ library which implements parts of the Avro Specification";

pkgs/by-name/aw/await/package.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     versionCheckHook
   ];
   doInstallCheck = true;
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   meta = with lib; {
     description = "Small binary that runs a list of commands in parallel and awaits termination";

pkgs/by-name/aw/aws-iam-authenticator/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.30";
+  version = "0.6.31";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-pgAk2qhsJTXbaXtdmKkA5GUIJt2ShWJ1mG6h0Zuh+Ng=";
+    hash = "sha256-v0CWwDLgjMU9kjPx5yUUauWNnzP0gP5zm4xCzBMPZpE=";
   };
 
   vendorHash = "sha256-dR98s5g2KFGJIFbgYHmW2813GEhLFZZvV5nja84a0Ik=";

pkgs/by-name/aw/aws-lc/package.nix

@@ -14,13 +14,13 @@ let
 in
 awsStdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.47.0";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Nf+UmtXbtWwkVT63eui5kINyzsmTYqCWXh8JlMHz1h8=";
+    hash = "sha256-xJ+CIuYEpRN/P96gs9SpdAJehHy0NEoMvsroYZAHARk=";
   };
 
   outputs = [

pkgs/by-name/az/azmq/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/zeromq/azmq";
     license = licenses.boost;
     description = "C++ language binding library integrating ZeroMQ with Boost Asio";
-    maintainers = with maintainers; [ azahi ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
 }

pkgs/by-name/az/azurehound/package.nix

@@ -28,7 +28,7 @@ buildGoModule rec {
 
   doInstallCheck = true;
 
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Azure Data Exporter for BloodHound";

pkgs/by-name/ba/bacon/package.nix

@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = lib.optionals withSound soundDependencies;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   postInstall =

pkgs/by-name/ba/basedpyright/package.nix

@@ -49,7 +49,7 @@ buildNpmPackage rec {
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
   passthru = {