Merge master into staging-nixos

.editorconfig

@@ -93,6 +93,9 @@ insert_final_newline = unset
 [*.jule]
 indent_style = tab
 
+[jule.mod]
+insert_final_newline = unset
+
 # Keep this hint at the bottom:
 # Please don't add entries for subfolders here.
 # Create <subfolder>/.editorconfig instead.

.git-blame-ignore-revs

@@ -193,6 +193,10 @@ cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
 # nixos/kanidm: inherit lib, nixfmt
 8f18393d380079904d072007fb19dc64baef0a3a
 
+# fetchgit, fetchurl, fetchzip:
+# format after refactoring with lib.extendMkDerivation (#455994)
+aeddd850c6d3485fc1af2edfb111e58141d18dc1
+
 # fetchhg: format after refactoring with lib.extendMkDerivation and make overridable (#423539)
 34a5b1eb23129f8fb62c677e3760903f6d43228f
 

.github/labeler-no-sync.yml

@@ -29,5 +29,6 @@
               - .github/actions/*
               - .github/workflows/*
               - ci/**/*.*
+              - maintainers/github-teams.json
 
 # keep-sorted end

.github/workflows/teams.yml

@@ -75,7 +75,7 @@ jobs:
           author: ${{ steps.user.outputs.git-string }}
           committer: ${{ steps.user.outputs.git-string }}
           commit-message: "maintainers/github-teams.json: Automated sync"
-          branch: github-team-sync
+          branch: pr/github-team-sync
           title: "maintainers/github-teams.json: Automated sync"
           body: |
             This is an automated PR to sync the GitHub teams with access to this repository to the `lib.teams` list.

doc/languages-frameworks/texlive.section.md

@@ -235,7 +235,7 @@ runCommand "test.pdf" { nativeBuildInputs = [ latex_with_foiltex ]; } ''
 The font cache for LuaLaTeX is written to `$HOME`.
 Therefore, it is necessary to set `$HOME` to a writable path, e.g. [before using LuaLaTeX in nix derivations](https://github.com/NixOS/nixpkgs/issues/180639):
 ```nix
-runCommandNoCC "lualatex-hello-world" { buildInputs = [ texliveFull ]; } ''
+runCommand "lualatex-hello-world" { buildInputs = [ texliveFull ]; } ''
   mkdir $out
   echo '\documentclass{article} \begin{document} Hello world \end{document}' > main.tex
   env HOME=$(mktemp -d) lualatex  -interaction=nonstopmode -output-format=pdf -output-directory=$out ./main.tex

lib/modules.nix

@@ -1126,6 +1126,29 @@ let
       __toString = _: showOption loc;
     };
 
+  # Check that a type with v2 merge has a coherent check attribute.
+  # Throws an error if the type uses an ad-hoc `type // { check }` override.
+  # Returns the last argument like `seq`, allowing usage: checkV2MergeCoherence loc type expr
+  checkV2MergeCoherence =
+    loc: type: result:
+    if type.check.isV2MergeCoherent or false then
+      result
+    else
+      throw ''
+        The option `${showOption loc}' has a type `${type.description}' that uses
+        an ad-hoc `type // { check = ...; }' override, which is incompatible with
+        the v2 merge mechanism.
+
+        Please use `lib.types.addCheck` instead of `type // { check }' to add
+        custom validation. For example:
+
+          lib.types.addCheck baseType (value: /* your check */)
+
+        instead of:
+
+          baseType // { check = value: /* your check */; }
+      '';
+
   # Merge definitions of a value of a given type.
   mergeDefinitions = loc: type: defs: rec {
     defsFinal' =
@@ -1201,10 +1224,13 @@ let
         (
           if type.merge ? v2 then
             let
-              r = type.merge.v2 {
-                inherit loc;
-                defs = defsFinal;
-              };
+              # Check for v2 merge coherence
+              r = checkV2MergeCoherence loc type (
+                type.merge.v2 {
+                  inherit loc;
+                  defs = defsFinal;
+                }
+              );
             in
             r
             // {

lib/tests/modules.sh

@@ -806,6 +806,25 @@ checkConfigError 'A definition for option .* is not of type .signed integer.*' c
 checkConfigOutput '^true$' config.v2checkedPass ./add-check.nix
 checkConfigError 'A definition for option .* is not of type .attribute set of signed integer.*' config.v2checkedFail ./add-check.nix
 
+# v2 merge check coherence
+# Tests checkV2MergeCoherence call in modules.nix (mergeDefinitions for lazyAttrsOf)
+checkConfigError 'ad-hoc.*override.*incompatible' config.adhocFail.foo ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in modules.nix (mergeDefinitions for lazyAttrsOf)
+checkConfigError 'ad-hoc.*override.*incompatible' config.adhocOuterFail.bar ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in types.nix (either t1)
+checkConfigError 'ad-hoc.*override.*incompatible' config.eitherLeftFail ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in types.nix (either t2)
+checkConfigError 'ad-hoc.*override.*incompatible' config.eitherRightFail ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in types.nix (coercedTo coercedType)
+checkConfigError 'ad-hoc.*override.*incompatible' config.coercedFromFail.bar ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in types.nix (coercedTo finalType)
+checkConfigError 'ad-hoc.*override.*incompatible' config.coercedToFail.foo ./v2-check-coherence.nix
+# Tests checkV2MergeCoherence call in types.nix (addCheck elemType)
+checkConfigError 'ad-hoc.*override.*incompatible' config.addCheckNested.foo ./v2-check-coherence.nix
+checkConfigError 'Please use.*lib.types.addCheck.*instead' config.adhocFail.foo ./v2-check-coherence.nix
+checkConfigError 'A definition for option .* is not of type .*' config.addCheckFail.bar.baz ./v2-check-coherence.nix
+checkConfigOutput '^true$' config.result ./v2-check-coherence.nix
+
 
 cat <<EOF
 ====== module tests ======

lib/tests/modules/v2-check-coherence.nix

@@ -0,0 +1,117 @@
+# Tests for v2 merge check coherence
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  # The problematic pattern: overriding check with //
+  # This inner type should reject everything (check always returns false)
+  adhocOverrideType = (types.lazyAttrsOf types.raw) // {
+    check = _: false;
+  };
+
+  # Using addCheck is the correct way to add custom checks
+  properlyCheckedType = types.addCheck (types.lazyAttrsOf types.raw) (v: v ? foo);
+
+  # Using addCheck with a check that will fail
+  failingCheckedType = types.addCheck (types.lazyAttrsOf types.raw) (v: v ? foo);
+
+  # Ad-hoc override on outer type
+  adhocOuterType = types.lazyAttrsOf types.int // {
+    check = _: false;
+  };
+
+  # Ad-hoc override on left side of either
+  adhocEitherLeft = types.lazyAttrsOf types.raw // {
+    check = _: false;
+  };
+
+  # Ad-hoc override on coercedType in coercedTo
+  adhocCoercedFrom = types.lazyAttrsOf types.raw // {
+    check = _: false;
+  };
+
+  # Ad-hoc override on finalType in coercedTo
+  adhocCoercedTo = types.lazyAttrsOf types.raw // {
+    check = _: false;
+  };
+
+  # Ad-hoc override wrapped in addCheck
+  adhocAddCheck = types.addCheck (types.lazyAttrsOf types.raw // { check = _: false; }) (v: true);
+in
+{
+  # Test 1: Ad-hoc check override in nested type should be detected
+  options.adhocFail = mkOption {
+    type = types.lazyAttrsOf adhocOverrideType;
+    default = { };
+  };
+  config.adhocFail = {
+    foo = { };
+  };
+
+  # Test 1b: Ad-hoc check override in outer type should be detected
+  options.adhocOuterFail = mkOption {
+    type = adhocOuterType;
+    default = { };
+  };
+  config.adhocOuterFail.bar = 42;
+
+  # Test 1c: Ad-hoc check override on left side of either type
+  options.eitherLeftFail = mkOption {
+    type = types.either adhocEitherLeft types.int;
+  };
+  config.eitherLeftFail.foo = { };
+
+  # Test 1d: Ad-hoc check override on right side of either type
+  options.eitherRightFail = mkOption {
+    type = types.either types.int (types.lazyAttrsOf types.raw // { check = _: false; });
+  };
+  config.eitherRightFail.foo = { };
+
+  # Test 1e: Ad-hoc check override on coercedType in coercedTo
+  options.coercedFromFail = mkOption {
+    type = types.coercedTo adhocCoercedFrom (x: { bar = 1; }) (types.lazyAttrsOf types.int);
+  };
+  config.coercedFromFail = {
+    foo = { };
+  };
+
+  # Test 1f: Ad-hoc check override on finalType in coercedTo
+  options.coercedToFail = mkOption {
+    type = types.coercedTo types.str (x: { }) adhocCoercedTo;
+  };
+  config.coercedToFail.foo = { };
+
+  # Test 1g: Ad-hoc check override wrapped in addCheck
+  options.addCheckNested = mkOption {
+    type = adhocAddCheck;
+  };
+  config.addCheckNested.foo = { };
+
+  # Test 2: Using addCheck should work correctly
+  options.addCheckPass = mkOption {
+    type = types.lazyAttrsOf properlyCheckedType;
+    default = { };
+  };
+  config.addCheckPass.bar.foo = "value";
+
+  # Test 3: addCheck should validate values properly
+  options.addCheckFail = mkOption {
+    type = types.lazyAttrsOf failingCheckedType;
+    default = { };
+  };
+  config.addCheckFail.bar.baz = "value"; # Missing required 'foo' attribute
+
+  # Test 4: Normal v2 types should work without coherence errors
+  options.normalPass = mkOption {
+    type = types.lazyAttrsOf (types.attrsOf types.int);
+    default = { };
+  };
+  config.normalPass.foo.bar = 42;
+
+  # Success assertion - only checks things that should succeed
+  options.result = mkOption {
+    type = types.bool;
+    default = false;
+  };
+  config.result = true;
+}

lib/types.nix

@@ -106,6 +106,29 @@ let
     in
     if invalidDefs != [ ] then { message = "Definition values: ${showDefs invalidDefs}"; } else null;
 
+  # Check that a type with v2 merge has a coherent check attribute.
+  # Throws an error if the type uses an ad-hoc `type // { check }` override.
+  # Returns the last argument like `seq`, allowing usage: checkV2MergeCoherence loc type expr
+  checkV2MergeCoherence =
+    loc: type: result:
+    if type.check.isV2MergeCoherent or false then
+      result
+    else
+      throw ''
+        The option `${showOption loc}' has a type `${type.description}' that uses
+        an ad-hoc `type // { check = ...; }' override, which is incompatible with
+        the v2 merge mechanism.
+
+        Please use `lib.types.addCheck` instead of `type // { check }' to add
+        custom validation. For example:
+
+          lib.types.addCheck baseType (value: /* your check */)
+
+        instead of:
+
+          baseType // { check = value: /* your check */; }
+      '';
+
   outer_types = rec {
     isType = type: x: (x._type or "") == type;
 
@@ -694,7 +717,10 @@ let
             optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType
           }";
           descriptionClass = "composite";
-          check = isList;
+          check = {
+            __functor = _self: isList;
+            isV2MergeCoherent = true;
+          };
           merge = {
             __functor =
               self: loc: defs:
@@ -807,7 +833,10 @@ let
             (if lazy then "lazy attribute set" else "attribute set")
             + " of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
           descriptionClass = "composite";
-          check = isAttrs;
+          check = {
+            __functor = _self: isAttrs;
+            isV2MergeCoherent = true;
+          };
           merge = {
             __functor =
               self: loc: defs:
@@ -1219,7 +1248,10 @@ let
 
           name = "submodule";
 
-          check = x: isAttrs x || isFunction x || path.check x;
+          check = {
+            __functor = _self: x: isAttrs x || isFunction x || path.check x;
+            isV2MergeCoherent = true;
+          };
         in
         mkOptionType {
           inherit name;
@@ -1403,7 +1435,10 @@ let
                 ) t2
               }";
           descriptionClass = "conjunction";
-          check = x: t1.check x || t2.check x;
+          check = {
+            __functor = _self: x: t1.check x || t2.check x;
+            isV2MergeCoherent = true;
+          };
           merge = {
             __functor =
               self: loc: defs:
@@ -1413,7 +1448,7 @@ let
               let
                 t1CheckedAndMerged =
                   if t1.merge ? v2 then
-                    t1.merge.v2 { inherit loc defs; }
+                    checkV2MergeCoherence loc t1 (t1.merge.v2 { inherit loc defs; })
                   else
                     {
                       value = t1.merge loc defs;
@@ -1422,7 +1457,7 @@ let
                     };
                 t2CheckedAndMerged =
                   if t2.merge ? v2 then
-                    t2.merge.v2 { inherit loc defs; }
+                    checkV2MergeCoherence loc t2 (t2.merge.v2 { inherit loc defs; })
                   else
                     {
                       value = t2.merge loc defs;
@@ -1492,7 +1527,10 @@ let
           description = "${optionDescriptionPhrase (class: class == "noun") finalType} or ${
             optionDescriptionPhrase (class: class == "noun") coercedType
           } convertible to it";
-          check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
+          check = {
+            __functor = _self: x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
+            isV2MergeCoherent = true;
+          };
           merge = {
             __functor =
               self: loc: defs:
@@ -1507,10 +1545,16 @@ let
                     // {
                       value =
                         let
-                          merged = coercedType.merge.v2 {
-                            inherit loc;
-                            defs = [ def ];
-                          };
+                          merged =
+                            if coercedType.merge ? v2 then
+                              checkV2MergeCoherence loc coercedType (
+                                coercedType.merge.v2 {
+                                  inherit loc;
+                                  defs = [ def ];
+                                }
+                              )
+                            else
+                              null;
                         in
                         if coercedType.merge ? v2 then
                           if merged.headError == null then coerceFunc def.value else def.value
@@ -1523,10 +1567,12 @@ let
                 );
               in
               if finalType.merge ? v2 then
-                finalType.merge.v2 {
-                  inherit loc;
-                  defs = finalDefs;
-                }
+                checkV2MergeCoherence loc finalType (
+                  finalType.merge.v2 {
+                    inherit loc;
+                    defs = finalDefs;
+                  }
+                )
               else
                 {
                   value = finalType.merge loc finalDefs;
@@ -1559,7 +1605,10 @@ let
         if elemType.merge ? v2 then
           elemType
           // {
-            check = x: elemType.check x && check x;
+            check = {
+              __functor = _self: x: elemType.check x && check x;
+              isV2MergeCoherent = true;
+            };
             merge = {
               __functor =
                 self: loc: defs:
@@ -1567,7 +1616,7 @@ let
               v2 =
                 { loc, defs }:
                 let
-                  orig = elemType.merge.v2 { inherit loc defs; };
+                  orig = checkV2MergeCoherence loc elemType (elemType.merge.v2 { inherit loc defs; });
                   headError' = if orig.headError != null then orig.headError else checkDefsForError check loc defs;
                 in
                 orig

maintainers/github-teams.json

@@ -211,7 +211,6 @@
       "domenkozar": 126339,
       "donn": 12652988,
       "dwt": 57199,
-      "eliandoran": 21236836,
       "emilazy": 18535642,
       "ethancedwards8": 60861925,
       "fiddlerwoaroof": 808745,
@@ -502,7 +501,7 @@
     "name": "kodi"
   },
   "kubernetes": {
-    "description": "",
+    "description": "Maintain the Kubernetes package and module",
     "id": 5536808,
     "maintainers": {
       "johanot": 998763,
@@ -514,7 +513,7 @@
     "name": "kubernetes"
   },
   "linux-kernel": {
-    "description": "",
+    "description": "Maintain the Linux kernel",
     "id": 13371617,
     "maintainers": {
       "alyssais": 2768870
@@ -912,17 +911,6 @@
     },
     "name": "SDL"
   },
-  "security": {
-    "description": "Private reports: security@nixos.org",
-    "id": 2197543,
-    "maintainers": {
-      "LeSuisse": 737767,
-      "mweinelt": 131599,
-      "risicle": 807447
-    },
-    "members": {},
-    "name": "Security"
-  },
   "static": {
     "description": "People interested in static builds (creation of `.a` files, fully static executables, etc.) and keeping them working",
     "id": 5906550,

maintainers/maintainer-list.nix

@@ -23530,6 +23530,14 @@
     githubId = 5791019;
     name = "Jiuyang Liu";
   };
+  Sereja313 = {
+    name = "Sergey Gulin";
+    github = "Sereja313";
+    githubId = 112060595;
+    email = "sergeygulin96@gmail.com";
+    matrix = "@sereja:sereja.xyz";
+    keys = [ { fingerprint = "AEF0 79C6 7618 8929 4124  22DB 3AB4 2DF3 F50E 3420"; } ];
+  };
   serge = {
     email = "sb@canva.com";
     github = "serge-belov";
@@ -27087,6 +27095,11 @@
     githubId = 5155100;
     name = "Utkarsh Gupta";
   };
+  utopiatopia = {
+    github = "utopiatopia";
+    githubId = 98685984;
+    name = "utopiatopia";
+  };
   uvnikita = {
     email = "uv.nikita@gmail.com";
     github = "uvNikita";

maintainers/team-list.nix

@@ -358,8 +358,7 @@ with lib.maintainers;
       _0x4A6F
       MattSturgeon
       jfly
-      # Not in the maintainer list
-      # Sereja313
+      Sereja313
     ];
     scope = "Nix formatting team: https://nixos.org/community/teams/formatting/";
     shortName = "Nix formatting team";

nixos/modules/config/getaddrinfo.nix

@@ -18,7 +18,7 @@ let
     [
       "# Generated by NixOS module networking.getaddrinfo"
       "# Do not edit manually!"
-      "reload ${if cfg.reload then "yes" else "no"}"
+      "reload ${lib.boolToYesNo cfg.reload}"
     ]
     ++ formatTableEntries "label" cfg.label
     ++ formatTableEntries "precedence" cfg.precedence

nixos/modules/misc/locate.nix

@@ -241,7 +241,7 @@ in
         PRUNEFS="${lib.concatStringsSep " " cfg.pruneFS}"
         PRUNENAMES="${lib.concatStringsSep " " cfg.pruneNames}"
         PRUNEPATHS="${lib.concatStringsSep " " cfg.prunePaths}"
-        PRUNE_BIND_MOUNTS="${if cfg.pruneBindMounts then "yes" else "no"}"
+        PRUNE_BIND_MOUNTS="${lib.boolToYesNo cfg.pruneBindMounts}"
       '';
 
       systemPackages = [ cfg.package ];
@@ -267,7 +267,7 @@ in
         ''
           exec ${cfg.package}/bin/updatedb \
             --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-            --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \
+            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
             ${lib.concatStringsSep " " cfg.extraFlags}
         '';
       serviceConfig = {

nixos/modules/programs/ssh.nix

@@ -357,7 +357,7 @@ in
       ]
       ++ lib.optional (!config.networking.enableIPv6) "AddressFamily inet"
       ++ lib.optional cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"
-      ++ lib.optional (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"
+      ++ lib.optional (cfg.forwardX11 != null) "ForwardX11 ${lib.boolToYesNo cfg.forwardX11}"
       ++ lib.optional (
         cfg.pubkeyAcceptedKeyTypes != [ ]
       ) "PubkeyAcceptedKeyTypes ${builtins.concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"

nixos/modules/security/auditd.nix

@@ -86,7 +86,7 @@ let
   prepareConfigValue =
     v:
     if lib.isBool v then
-      (if v then "yes" else "no")
+      lib.boolToYesNo v
     else if lib.isList v then
       lib.concatStringsSep " " (map prepareConfigValue v)
     else

nixos/modules/security/duosec.nix

@@ -6,8 +6,7 @@
 }:
 let
   cfg = config.security.duosec;
-
-  boolToStr = b: if b then "yes" else "no";
+  inherit (lib) boolToYesNo;
 
   configFilePam = ''
     [duo]
@@ -15,15 +14,15 @@ let
     host=${cfg.host}
     ${lib.optionalString (cfg.groups != "") ("groups=" + cfg.groups)}
     failmode=${cfg.failmode}
-    pushinfo=${boolToStr cfg.pushinfo}
-    autopush=${boolToStr cfg.autopush}
+    pushinfo=${boolToYesNo cfg.pushinfo}
+    autopush=${boolToYesNo cfg.autopush}
     prompts=${toString cfg.prompts}
-    fallback_local_ip=${boolToStr cfg.fallbackLocalIP}
+    fallback_local_ip=${boolToYesNo cfg.fallbackLocalIP}
   '';
 
   configFileLogin = configFilePam + ''
-    motd=${boolToStr cfg.motd}
-    accept_env_factor=${boolToStr cfg.acceptEnvFactor}
+    motd=${boolToYesNo cfg.motd}
+    accept_env_factor=${boolToYesNo cfg.acceptEnvFactor}
   '';
 in
 {

nixos/modules/security/pam_mount.nix

@@ -170,9 +170,7 @@ in
           <pam_mount>
           <debug enable="${toString cfg.debugLevel}" />
           <!-- if activated, requires ofl from hxtools to be present -->
-          <logout wait="${toString cfg.logoutWait}" hup="${if cfg.logoutHup then "yes" else "no"}" term="${
-            if cfg.logoutTerm then "yes" else "no"
-          }" kill="${if cfg.logoutKill then "yes" else "no"}" />
+          <logout wait="${toString cfg.logoutWait}" hup="${lib.boolToYesNo cfg.logoutHup}" term="${lib.boolToYesNo cfg.logoutTerm}" kill="${lib.boolToYesNo cfg.logoutKill}" />
           <!-- set PATH variable for pam_mount module -->
           <path>${lib.makeBinPath ([ pkgs.util-linux ] ++ cfg.additionalSearchPaths)}</path>
           <!-- create mount point if not present -->

nixos/modules/security/tpm2.nix

@@ -39,7 +39,7 @@ let
           ima_log_file = cfg.fapi.imaLogFile;
         }
         // lib.optionalAttrs (cfg.fapi.ekCertLess != null) {
-          ek_cert_less = if cfg.fapi.ekCertLess then "yes" else "no";
+          ek_cert_less = lib.boolToYesNo cfg.fapi.ekCertLess;
         }
         // lib.optionalAttrs (cfg.fapi.ekFingerprint != null) { ek_fingerprint = cfg.fapi.ekFingerprint; }
       )

nixos/modules/services/backup/bacula.nix

@@ -10,6 +10,7 @@
 
 let
   inherit (lib)
+    boolToYesNo
     concatStringsSep
     literalExpression
     mapAttrsToList
@@ -21,16 +22,15 @@ let
     ;
   libDir = "/var/lib/bacula";
 
-  yes_no = bool: if bool then "yes" else "no";
   tls_conf =
     tls_cfg:
     optionalString tls_cfg.enable (
       concatStringsSep "\n" (
         [ "TLS Enable = yes;" ]
-        ++ optional (tls_cfg.require != null) "TLS Require = ${yes_no tls_cfg.require};"
+        ++ optional (tls_cfg.require != null) "TLS Require = ${boolToYesNo tls_cfg.require};"
         ++ optional (tls_cfg.certificate != null) ''TLS Certificate = "${tls_cfg.certificate}";''
         ++ [ ''TLS Key = "${tls_cfg.key}";'' ]
-        ++ optional (tls_cfg.verifyPeer != null) "TLS Verify Peer = ${yes_no tls_cfg.verifyPeer};"
+        ++ optional (tls_cfg.verifyPeer != null) "TLS Verify Peer = ${boolToYesNo tls_cfg.verifyPeer};"
         ++ optional (
           tls_cfg.allowedCN != [ ]
         ) "TLS Allowed CN = ${concatStringsSep " " (tls_cfg.allowedCN)};"

nixos/modules/services/databases/cassandra.nix

@@ -504,7 +504,7 @@ in
         MAX_HEAP_SIZE = toString cfg.maxHeapSize;
         HEAP_NEWSIZE = toString cfg.heapNewSize;
         MALLOC_ARENA_MAX = toString cfg.mallocArenaMax;
-        LOCAL_JMX = if cfg.remoteJmx then "no" else "yes";
+        LOCAL_JMX = lib.boolToYesNo (!cfg.remoteJmx);
         JMX_PORT = toString cfg.jmxPort;
       };
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/mail/cyrus-imap.nix

@@ -15,6 +15,7 @@ let
     optionalString
     generators
     mapAttrsToList
+    boolToYesNo
     ;
   inherit (lib.strings) concatStringsSep;
   inherit (lib.types)
@@ -63,7 +64,7 @@ let
         mkValueString =
           v:
           if builtins.isBool v then
-            if v then "yes" else "no"
+            boolToYesNo v
           else if builtins.isList v then
             concatStringsSep " " v
           else

nixos/modules/services/mail/rspamd.nix

@@ -211,9 +211,7 @@ let
         ''
           worker "${value.type}" {
             type = "${value.type}";
-            ${optionalString (value.enable != null)
-              "enabled = ${if value.enable != false then "yes" else "no"};"
-            }
+            ${optionalString (value.enable != null) "enabled = ${lib.boolToYesNo (value.enable != false)};"}
             ${mkBindSockets value.enable value.bindSockets}
             ${optionalString (value.count != null) "count = ${toString value.count};"}
             ${concatStringsSep "\n  " (map (each: ".include \"${each}\"") value.includes)}

nixos/modules/services/misc/docker-registry.nix

@@ -48,7 +48,7 @@ in
   options.services.dockerRegistry = {
     enable = lib.mkEnableOption "Docker Registry";
 
-    package = lib.mkPackageOption pkgs "docker-distribution" {
+    package = lib.mkPackageOption pkgs "distribution" {
       example = "gitlab-container-registry";
     };
 

nixos/modules/services/misc/gammu-smsd.nix

@@ -11,7 +11,7 @@ let
     [gammu]
     Device = ${cfg.device.path}
     Connection = ${cfg.device.connection}
-    SynchronizeTime = ${if cfg.device.synchronizeTime then "yes" else "no"}
+    SynchronizeTime = ${lib.boolToYesNo cfg.device.synchronizeTime}
     LogFormat = ${cfg.log.format}
     ${lib.optionalString (cfg.device.pin != null) "PIN = ${cfg.device.pin}"}
     ${cfg.extraConfig.gammu}

nixos/modules/services/misc/gitlab.nix

@@ -588,12 +588,12 @@ in
             if versionAtLeast config.system.stateVersion "23.11" then
               pkgs.gitlab-container-registry
             else
-              pkgs.docker-distribution;
-          defaultText = literalExpression "pkgs.docker-distribution";
+              pkgs.distribution;
+          defaultText = literalExpression "pkgs.distribution";
           description = ''
             Container registry package to use.
 
-            External container registries such as `pkgs.docker-distribution` are not supported
+            External container registries such as `pkgs.distribution` are not supported
             anymore since GitLab 16.0.0.
           '';
         };
@@ -1179,7 +1179,7 @@ in
         (
           cfg.registry.enable
           && versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0"
-          && cfg.registry.package == pkgs.docker-distribution
+          && cfg.registry.package == pkgs.distribution
         )
         ''
           Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.

nixos/modules/services/misc/mediatomb.nix

@@ -12,7 +12,6 @@ let
   opt = options.services.mediatomb;
   name = cfg.package.pname;
   pkg = cfg.package;
-  optionYesNo = option: if option then "yes" else "no";
   # configuration on media directory
   mediaDirectory = {
     options = {
@@ -36,7 +35,7 @@ let
   };
   toMediaDirectory =
     d:
-    "<directory location=\"${d.path}\" mode=\"inotify\" recursive=\"${optionYesNo d.recursive}\" hidden-files=\"${optionYesNo d.hidden-files}\" />\n";
+    "<directory location=\"${d.path}\" mode=\"inotify\" recursive=\"${lib.boolToYesNo d.recursive}\" hidden-files=\"${lib.boolToYesNo d.hidden-files}\" />\n";
 
   transcodingConfig =
     if cfg.transcoding then
@@ -89,13 +88,13 @@ let
           <home>${cfg.dataDir}</home>
           <interface>${cfg.interface}</interface>
           <webroot>${pkg}/share/${name}/web</webroot>
-          <pc-directory upnp-hide="${optionYesNo cfg.pcDirectoryHide}"/>
+          <pc-directory upnp-hide="${lib.boolToYesNo cfg.pcDirectoryHide}"/>
           <storage>
             <sqlite3 enabled="yes">
               <database-file>${name}.db</database-file>
             </sqlite3>
           </storage>
-          <protocolInfo extend="${optionYesNo cfg.ps3Support}"/>
+          <protocolInfo extend="${lib.boolToYesNo cfg.ps3Support}"/>
           ${lib.optionalString cfg.dsmSupport ''
             <custom-http-headers>
               <add header="X-User-Agent: redsonic"/>

nixos/modules/services/network-filesystems/orangefs/server.nix

@@ -50,8 +50,8 @@ let
       </DataHandleRanges>
 
       <StorageHints>
-      TroveSyncMeta ${if fs.troveSyncMeta then "yes" else "no"}
-      TroveSyncData ${if fs.troveSyncData then "yes" else "no"}
+      TroveSyncMeta ${lib.boolToYesNo fs.troveSyncMeta}
+      TroveSyncData ${lib.boolToYesNo fs.troveSyncData}
       ${fs.extraStorageHints}
       </StorageHints>
 

nixos/modules/services/networking/avahi-daemon.nix

@@ -7,8 +7,6 @@
 let
   cfg = config.services.avahi;
 
-  yesNo = yes: if yes then "yes" else "no";
-
   avahiDaemonConf =
     with cfg;
     pkgs.writeText "avahi-daemon.conf" ''
@@ -21,8 +19,8 @@ let
         lib.optionalString (hostName != "") "host-name=${hostName}"
       }
       browse-domains=${lib.concatStringsSep ", " browseDomains}
-      use-ipv4=${yesNo ipv4}
-      use-ipv6=${yesNo ipv6}
+      use-ipv4=${lib.boolToYesNo ipv4}
+      use-ipv6=${lib.boolToYesNo ipv6}
       ${lib.optionalString (
         allowInterfaces != null
       ) "allow-interfaces=${lib.concatStringsSep "," allowInterfaces}"}
@@ -30,22 +28,22 @@ let
         denyInterfaces != null
       ) "deny-interfaces=${lib.concatStringsSep "," denyInterfaces}"}
       ${lib.optionalString (domainName != null) "domain-name=${domainName}"}
-      allow-point-to-point=${yesNo allowPointToPoint}
+      allow-point-to-point=${lib.boolToYesNo allowPointToPoint}
       ${lib.optionalString (cacheEntriesMax != null) "cache-entries-max=${toString cacheEntriesMax}"}
 
       [wide-area]
-      enable-wide-area=${yesNo wideArea}
+      enable-wide-area=${lib.boolToYesNo wideArea}
 
       [publish]
-      disable-publishing=${yesNo (!publish.enable)}
-      disable-user-service-publishing=${yesNo (!publish.userServices)}
-      publish-addresses=${yesNo (publish.userServices || publish.addresses)}
-      publish-hinfo=${yesNo publish.hinfo}
-      publish-workstation=${yesNo publish.workstation}
-      publish-domain=${yesNo publish.domain}
+      disable-publishing=${lib.boolToYesNo (!publish.enable)}
+      disable-user-service-publishing=${lib.boolToYesNo (!publish.userServices)}
+      publish-addresses=${lib.boolToYesNo (publish.userServices || publish.addresses)}
+      publish-hinfo=${lib.boolToYesNo publish.hinfo}
+      publish-workstation=${lib.boolToYesNo publish.workstation}
+      publish-domain=${lib.boolToYesNo publish.domain}
 
       [reflector]
-      enable-reflector=${yesNo reflector}
+      enable-reflector=${lib.boolToYesNo reflector}
       ${extraConfig}
     '';
 in

nixos/modules/services/networking/ddclient.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.services.ddclient;
-  boolToStr = bool: if bool then "yes" else "no";
   dataDir = "/var/lib/ddclient";
   StateDirectory = builtins.baseNameOf dataDir;
   RuntimeDirectory = StateDirectory;
@@ -33,10 +32,10 @@ let
     ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
     ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
     ${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
-    ssl=${boolToStr cfg.ssl}
+    ssl=${lib.boolToYesNo cfg.ssl}
     wildcard=YES
-    quiet=${boolToStr cfg.quiet}
-    verbose=${boolToStr cfg.verbose}
+    quiet=${lib.boolToYesNo cfg.quiet}
+    verbose=${lib.boolToYesNo cfg.verbose}
     ${cfg.extraConfig}
     ${lib.concatStringsSep "," cfg.domains}
   '';

nixos/modules/services/networking/frr.nix

@@ -82,7 +82,7 @@ let
 
   isEnabled = service: cfg.${service}.enable;
 
-  daemonLine = d: "${d}=${if isEnabled d then "yes" else "no"}";
+  daemonLine = d: "${d}=${lib.boolToYesNo (isEnabled d)}";
 
   configFile =
     if cfg.configFile != null then

nixos/modules/services/networking/miniupnpd.nix

@@ -11,8 +11,8 @@ let
   cfg = config.services.miniupnpd;
   configFile = pkgs.writeText "miniupnpd.conf" ''
     ext_ifname=${cfg.externalInterface}
-    enable_natpmp=${if cfg.natpmp then "yes" else "no"}
-    enable_upnp=${if cfg.upnp then "yes" else "no"}
+    enable_natpmp=${boolToYesNo cfg.natpmp}
+    enable_upnp=${boolToYesNo cfg.upnp}
 
     ${concatMapStrings (range: ''
       listening_ip=${range}

nixos/modules/services/networking/nsd.nix

@@ -100,19 +100,19 @@ let
       # interfaces
     ${forEach "  ip-address: " cfg.interfaces}
 
-      ip-freebind:         ${yesOrNo cfg.ipFreebind}
-      hide-version:        ${yesOrNo cfg.hideVersion}
+      ip-freebind:         ${boolToYesNo cfg.ipFreebind}
+      hide-version:        ${boolToYesNo cfg.hideVersion}
       identity:            "${cfg.identity}"
-      ip-transparent:      ${yesOrNo cfg.ipTransparent}
-      do-ip4:              ${yesOrNo cfg.ipv4}
+      ip-transparent:      ${boolToYesNo cfg.ipTransparent}
+      do-ip4:              ${boolToYesNo cfg.ipv4}
       ipv4-edns-size:      ${toString cfg.ipv4EDNSSize}
-      do-ip6:              ${yesOrNo cfg.ipv6}
+      do-ip6:              ${boolToYesNo cfg.ipv6}
       ipv6-edns-size:      ${toString cfg.ipv6EDNSSize}
-      log-time-ascii:      ${yesOrNo cfg.logTimeAscii}
+      log-time-ascii:      ${boolToYesNo cfg.logTimeAscii}
       ${maybeString "nsid: " cfg.nsid}
       port:                ${toString cfg.port}
-      reuseport:           ${yesOrNo cfg.reuseport}
-      round-robin:         ${yesOrNo cfg.roundRobin}
+      reuseport:           ${boolToYesNo cfg.reuseport}
+      round-robin:         ${boolToYesNo cfg.roundRobin}
       server-count:        ${toString cfg.serverCount}
       ${maybeToString "statistics: " cfg.statistics}
       tcp-count:           ${toString cfg.tcpCount}
@@ -121,7 +121,7 @@ let
       verbosity:           ${toString cfg.verbosity}
       ${maybeString "version: " cfg.version}
       xfrd-reload-timeout: ${toString cfg.xfrdReloadTimeout}
-      zonefiles-check:     ${yesOrNo cfg.zonefilesCheck}
+      zonefiles-check:     ${boolToYesNo cfg.zonefilesCheck}
       zonefiles-write:     ${toString cfg.zonefilesWrite}
 
       ${maybeString "rrl-ipv4-prefix-length: " cfg.ratelimit.ipv4PrefixLength}
@@ -134,7 +134,7 @@ let
     ${keyConfigFile}
 
     remote-control:
-      control-enable:    ${yesOrNo cfg.remoteControl.enable}
+      control-enable:    ${boolToYesNo cfg.remoteControl.enable}
       control-key-file:  "${cfg.remoteControl.controlKeyFile}"
       control-cert-file: "${cfg.remoteControl.controlCertFile}"
     ${forEach "  control-interface: " cfg.remoteControl.interfaces}
@@ -147,7 +147,6 @@ let
     ${cfg.extraConfig}
   '';
 
-  yesOrNo = b: if b then "yes" else "no";
   maybeString = prefix: x: optionalString (x != null) ''${prefix} "${x}"'';
   maybeToString = prefix: x: optionalString (x != null) ''${prefix} ${toString x}'';
   forEach = pre: l: concatMapStrings (x: pre + x + "\n") l;
@@ -183,8 +182,8 @@ let
       ${maybeToString "max-retry-time:   " zone.maxRetrySecs}
       ${maybeToString "min-retry-time:   " zone.minRetrySecs}
 
-      allow-axfr-fallback: ${yesOrNo zone.allowAXFRFallback}
-      multi-master-check: ${yesOrNo zone.multiMasterCheck}
+      allow-axfr-fallback: ${boolToYesNo zone.allowAXFRFallback}
+      multi-master-check: ${boolToYesNo zone.multiMasterCheck}
     ${forEach "  allow-notify: " zone.allowNotify}
     ${forEach "  request-xfr: " zone.requestXFR}
 

nixos/modules/services/networking/pdns-recursor.nix

@@ -21,7 +21,6 @@ let
     ];
   configType = with types; attrsOf (nullOr (oneOrMore valueType));
 
-  toBool = val: if val then "yes" else "no";
   serialize =
     val:
     with types;
@@ -32,7 +31,7 @@ let
     else if path.check val then
       toString val
     else if bool.check val then
-      toBool val
+      boolToYesNo val
     else if builtins.isList val then
       (concatMapStringsSep "," serialize val)
     else

nixos/modules/services/networking/smartdns.nix

@@ -23,7 +23,7 @@ let
     with generators;
     toKeyValue {
       mkKeyValue = mkKeyValueDefault {
-        mkValueString = v: if isBool v then if v then "yes" else "no" else mkValueStringDefault { } v;
+        mkValueString = v: if isBool v then boolToYesNo v else mkValueStringDefault { } v;
       } " ";
       listsAsDuplicateKeys = true; # Allowing duplications because we need to deal with multiple entries with the same key.
     } cfg.settings

nixos/modules/services/networking/ssh/sshd.nix

@@ -484,7 +484,6 @@ in
               };
               UseDns = lib.mkOption {
                 type = lib.types.nullOr lib.types.bool;
-                # apply if cfg.useDns then "yes" else "no"
                 default = false;
                 description = ''
                   Specifies whether {manpage}`sshd(8)` should look up the remote host name, and to check that the resolved host name for

nixos/modules/services/networking/strongswan-swanctl/param-constructors.nix

@@ -97,7 +97,7 @@ rec {
       default = null;
       description = documentDefault description strongswanDefault;
     };
-    render = single (b: if b then "yes" else "no");
+    render = single boolToYesNo;
   };
   yes = true;
   no = false;

nixos/modules/services/networking/stunnel.nix

@@ -7,7 +7,6 @@
 let
 
   cfg = config.services.stunnel;
-  yesNo = val: if val then "yes" else "no";
 
   verifyRequiredField = type: field: n: c: {
     assertion = lib.hasAttr field c;
@@ -23,13 +22,7 @@ let
 
   removeNulls = lib.mapAttrs (_: lib.filterAttrs (_: v: v != null));
   mkValueString =
-    v:
-    if v == true then
-      "yes"
-    else if v == false then
-      "no"
-    else
-      lib.generators.mkValueStringDefault { } v;
+    v: if lib.isBool v then lib.boolToYesNo v else lib.generators.mkValueStringDefault { } v;
   generateConfig =
     c:
     lib.generators.toINI {

nixos/modules/services/networking/tayga.nix

@@ -28,7 +28,7 @@ let
       log ${concatStringsSep " " cfg.log}
     ''}
 
-    wkpf-strict ${if cfg.wkpfStrict then "yes" else "no"}
+    wkpf-strict ${boolToYesNo cfg.wkpfStrict}
   '';
 
   addrOpts =

nixos/modules/services/networking/unbound.nix

@@ -9,8 +9,6 @@ with lib;
 let
   cfg = config.services.unbound;
 
-  yesOrNo = v: if v then "yes" else "no";
-
   toOption =
     indent: n: v:
     "${indent}${toString n}: ${v}";
@@ -22,7 +20,7 @@ let
     else if isInt v then
       (toOption indent n (toString v))
     else if isBool v then
-      (toOption indent n (yesOrNo v))
+      (toOption indent n (lib.boolToYesNo v))
     else if isString v then
       (toOption indent n v)
     else if isList v then

nixos/modules/services/networking/xinetd.nix

@@ -31,7 +31,7 @@ let
       ${optionalString (srv.flags != "") "flags = ${srv.flags}"}
       socket_type = ${if srv.protocol == "udp" then "dgram" else "stream"}
       ${optionalString (srv.port != 0) "port        = ${toString srv.port}"}
-      wait        = ${if srv.protocol == "udp" then "yes" else "no"}
+      wait        = ${lib.boolToYesNo (srv.protocol == "udp")}
       user        = ${srv.user}
       server      = ${srv.server}
       ${optionalString (srv.serverArgs != "") "server_args = ${srv.serverArgs}"}

nixos/modules/tasks/network-interfaces-systemd.nix

@@ -18,7 +18,7 @@ let
 
   interfaceRoutes = i: i.ipv4.routes ++ optionals cfg.enableIPv6 i.ipv6.routes;
 
-  dhcpStr = useDHCP: if useDHCP == true || useDHCP == null then "yes" else "no";
+  dhcpStr = useDHCP: boolToYesNo (useDHCP == true || useDHCP == null);
 
   slaves =
     concatLists (map (bond: bond.interfaces) (attrValues cfg.bonds))

nixos/tests/acme/http01-builtin.nix

@@ -126,7 +126,7 @@ in
                 DNS.1 = ${config.networking.fqdn}
               '';
               csrData =
-                pkgs.runCommandNoCC "csr-and-key"
+                pkgs.runCommand "csr-and-key"
                   {
                     buildInputs = [ pkgs.openssl ];
                   }

nixos/tests/kanidm-provisioning.nix

@@ -4,7 +4,7 @@ let
   serverDomain = certs.domain;
 
   # copy certs to store to work around mount namespacing
-  certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+  certsPath = pkgs.runCommand "snakeoil-certs" { } ''
     mkdir $out
     cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
     cp ${certs."${serverDomain}".key} $out/snakeoil.key

nixos/tests/kanidm.nix

@@ -8,7 +8,7 @@ let
   };
 
   # copy certs to store to work around mount namespacing
-  certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+  certsPath = pkgs.runCommand "snakeoil-certs" { } ''
     mkdir $out
     cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
     cp ${certs."${serverDomain}".key} $out/snakeoil.key

nixos/tests/nix-required-mounts/ensure-path-not-present.nix

@@ -3,7 +3,7 @@
   feature,
 }:
 
-pkgs.runCommandNoCC "${feature}-not-present" { } ''
+pkgs.runCommand "${feature}-not-present" { } ''
   if [[ -e /${feature}-files ]]; then
     echo "No ${feature} in requiredSystemFeatures, but /${feature}-files was mounted anyway"
     exit 1

nixos/tests/nix-required-mounts/test-require-feature.nix

@@ -3,7 +3,7 @@
   feature,
 }:
 
-pkgs.runCommandNoCC "${feature}-present" { requiredSystemFeatures = [ feature ]; } ''
+pkgs.runCommand "${feature}-present" { requiredSystemFeatures = [ feature ]; } ''
   if [[ ! -e /${feature}-files ]]; then
     echo "The host declares ${feature} support, but doesn't expose /${feature}-files" >&2
     exit 1

nixos/tests/nix-required-mounts/test-structured-attrs-empty.nix

@@ -2,7 +2,6 @@
   pkgs ? import <nixpkgs> { },
 }:
 
-pkgs.runCommandNoCC "nix-required-mounts-structured-attrs-no-features" { __structuredAttrs = true; }
-  ''
-    touch $out
-  ''
+pkgs.runCommand "nix-required-mounts-structured-attrs-no-features" { __structuredAttrs = true; } ''
+  touch $out
+''

nixos/tests/nix-required-mounts/test-structured-attrs.nix

@@ -3,7 +3,7 @@
   feature,
 }:
 
-pkgs.runCommandNoCC "${feature}-present-structured"
+pkgs.runCommand "${feature}-present-structured"
   {
     __structuredAttrs = true;
     requiredSystemFeatures = [ feature ];

pkgs/applications/editors/vim/plugins/generated.nix

@@ -17004,6 +17004,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-buftabline = buildVimPlugin {
+    pname = "vim-buftabline";
+    version = "2020-12-13";
+    src = fetchFromGitHub {
+      owner = "ap";
+      repo = "vim-buftabline";
+      rev = "73b9ef5dcb6cdf6488bc88adb382f20bc3e3262a";
+      sha256 = "1vs4km7fb3di02p0771x42y2bsn1hi4q6iwlbrj0imacd9affv5y";
+    };
+    meta.homepage = "https://github.com/ap/vim-buftabline/";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-caddyfile = buildVimPlugin {
     pname = "vim-caddyfile";
     version = "2025-07-22";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1305,6 +1305,7 @@ https://github.com/mtikekar/vim-bsv/,,
 https://github.com/jeetsukumaran/vim-buffergator/,,
 https://github.com/bling/vim-bufferline/,,
 https://github.com/qpkorr/vim-bufkill/,,
+https://github.com/ap/vim-buftabline/,HEAD,
 https://github.com/isobit/vim-caddyfile/,HEAD,
 https://github.com/tpope/vim-capslock/,,
 https://github.com/kristijanhusak/vim-carbon-now-sh/,,

pkgs/applications/misc/chewing-editor/default.nix

@@ -1,46 +1,53 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
+  gtest,
   cmake,
   pkg-config,
   libchewing,
+  qt5,
   qtbase,
   qttools,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "chewing-editor";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "chewing";
     repo = "chewing-editor";
-    rev = version;
-    sha256 = "0kc2hjx1gplm3s3p1r5sn0cyxw3k1q4gyv08q9r6rs4sg7xh2w7w";
+    tag = version;
+    hash = "sha256-gF3OotO/xb3Dc0YjVwAKIYnuEPIrgjpGR2tdjOBT4aI=";
   };
 
   doCheck = true;
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     pkg-config
+    qt5.wrapQtAppsHook
   ];
   buildInputs = [
+    gtest
     libchewing
     qtbase
     qttools
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Cross platform chewing user phrase editor";
     mainProgram = "chewing-editor";
     longDescription = ''
       chewing-editor is a cross platform chewing user phrase editor. It provides a easy way to manage user phrase. With it, user can customize their user phrase to increase input performance.
     '';
     homepage = "https://github.com/chewing/chewing-editor";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.ShamrockLee ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ ShamrockLee ];
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/applications/misc/openbangla-keyboard/Cargo.lock

@@ -4,105 +4,108 @@ version = 3
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
+ "cfg-if",
  "getrandom",
  "once_cell",
+ "serde",
  "version_check",
+ "zerocopy",
 ]
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
 
 [[package]]
 name = "edit-distance"
-version = "2.1.0"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbbaaaf38131deb9ca518a274a45bfdb8771f139517b073b16c2d3d32ae5037b"
+checksum = "e3f497e87b038c09a155dfd169faa5ec940d0644635555ef6bd464ac20e97397"
 
 [[package]]
 name = "emojicon"
-version = "0.3.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349cbfb1ca5301d8492ff741487f98fed75957c5e8fee41485e3413359099ef9"
+checksum = "328e1bb7f1b2b87859d560af9ca245e7a0ca664adad1879cb6bd2d49b7501fd4"
+
+[[package]]
+name = "fst"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
  "libc",
+ "r-efi",
  "wasi",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "libc"
-version = "0.2.148"
+version = "0.2.176"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
-
-[[package]]
-name = "matches"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
+checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174"
 
 [[package]]
 name = "memchr"
-version = "2.6.3"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "okkhor"
-version = "0.5.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ef452078c9fb34be8842a52484bf9271e01ac2795e3d15ee90357fb45c102f"
+checksum = "0bc911c392067af1e3c7cde21774ea70dd285b4125b5e3d5febc283b76b9d6a4"
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
 
 [[package]]
 name = "phf"
-version = "0.10.1"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
  "phf_macros",
  "phf_shared",
- "proc-macro-hack",
 ]
 
 [[package]]
 name = "phf_generator"
-version = "0.10.0"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
  "phf_shared",
  "rand",
@@ -110,85 +113,65 @@ dependencies = [
 
 [[package]]
 name = "phf_macros"
-version = "0.10.0"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
 dependencies = [
  "phf_generator",
  "phf_shared",
- "proc-macro-hack",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
 name = "phf_shared"
-version = "0.10.0"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
 dependencies = [
  "siphasher",
 ]
 
 [[package]]
 name = "poriborton"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c081c9ef49e856f39ccd59e4943582b1e47225eb01b0debc1d388c4daa55b0dd"
+checksum = "964aa77aab32f321000ec0b121ab2a27565e051fb7ff979c22d6e21a90376f14"
 dependencies = [
- "matches",
  "phf",
 ]
 
-[[package]]
-name = "ppv-lite86"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
-
-[[package]]
-name = "proc-macro-hack"
-version = "0.5.20+deprecated"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
-
 [[package]]
 name = "proc-macro2"
-version = "1.0.67"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "rand"
 version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "libc",
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
  "rand_core",
 ]
 
@@ -197,9 +180,6 @@ name = "rand_core"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom",
-]
 
 [[package]]
 name = "regex"
@@ -240,52 +220,72 @@ dependencies = [
  "okkhor",
  "poriborton",
  "regex",
+ "rustversion",
  "serde_json",
  "stringplus",
+ "upodesh",
 ]
 
 [[package]]
-name = "ryu"
-version = "1.0.15"
+name = "rustversion"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "serde"
-version = "1.0.188"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.188"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.37",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
  "itoa",
+ "memchr",
  "ryu",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "siphasher"
-version = "0.3.11"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
 
 [[package]]
 name = "stringplus"
@@ -295,20 +295,9 @@ checksum = "9057d3b491a3eee749e52560657c4d93b0badc04fb3fa8dae3c942c5c066f222"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -317,18 +306,68 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+
+[[package]]
+name = "upodesh"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af0dcd57dc7aa39411df5c9c8046ee7439a619e7881a43aba328bd533ae54a91"
+dependencies = [
+ "fst",
+ "once_cell",
+ "serde",
+ "serde_json",
+]
 
 [[package]]
 name = "version_check"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.14.7+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+
+[[package]]
+name = "zerocopy"
+version = "0.8.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

pkgs/applications/misc/openbangla-keyboard/default.nix

@@ -12,34 +12,22 @@
   ibus,
   qtbase,
   zstd,
-  fetchpatch,
   withFcitx5Support ? false,
   withIbusSupport ? false,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openbangla-keyboard";
-  version = "unstable-2023-07-21";
+  version = "2.0.0-unstable-2025-08-19";
 
   src = fetchFromGitHub {
     owner = "openbangla";
     repo = "openbangla-keyboard";
-    # no upstream release in 3 years
-    # fcitx5 support was added over a year after the last release
-    rev = "780bd40eed16116222faff044bfeb61a07af158f";
-    hash = "sha256-4CR4lgHB51UvS/RLc0AEfIKJ7dyTCOfDrQdGLf9de8E=";
+    rev = "723e348ad2cb0607684d907ce8a9457e12993f4f";
+    hash = "sha256-XAcL4gBcu84DMR6o9JSJ/PmI1PsDdTETknD6C48E8ek=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # prevents runtime crash when fcitx5-based IM attempts to look in /usr
-    (fetchpatch {
-      name = "use-CMAKE_INSTALL_PREFIX-for-loading-data.patch";
-      url = "https://github.com/OpenBangla/OpenBangla-Keyboard/commit/f402472780c29eaa6b4cc841a70289adf171462b.diff";
-      hash = "sha256-YahvtyOxe8F40Wfe+31C6fdmm197QN26/Q67oinOplk=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -62,8 +50,8 @@ stdenv.mkDerivation rec {
     ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src cargoRoot postPatch;
-    hash = "sha256-qZMTZi7eqEp5kSmVx7qdS7eDKOzSv9fMjWT0h/MGyeY=";
+    inherit (finalAttrs) src cargoRoot postPatch;
+    hash = "sha256-UrS12fcXIIT3xhl/nyegwROBMCIepi6n07CS5CEA2BY=";
   };
 
   cmakeFlags =
@@ -76,7 +64,7 @@ stdenv.mkDerivation rec {
 
   cargoRoot = "src/engine/riti";
   postPatch = ''
-    cp ${./Cargo.lock} ${cargoRoot}/Cargo.lock
+    cp ${./Cargo.lock} ${finalAttrs.cargoRoot}/Cargo.lock
   '';
 
   meta = {
@@ -85,9 +73,12 @@ stdenv.mkDerivation rec {
     mainProgram = "openbangla-gui";
     homepage = "https://openbangla.github.io/";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ hqurve ];
+    maintainers = with lib.maintainers; [
+      hqurve
+      johnrtitor
+    ];
     platforms = lib.platforms.linux;
     # never built on aarch64-linux since first introduction in nixpkgs
     broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
   };
-}
+})

pkgs/applications/misc/redshift/default.nix

@@ -70,12 +70,12 @@ let
       ++ lib.optionals (pname == "gammastep") [ wayland-scanner ];
 
       configureFlags = [
-        "--enable-randr=${if withRandr then "yes" else "no"}"
-        "--enable-geoclue2=${if withGeoclue then "yes" else "no"}"
-        "--enable-drm=${if withDrm then "yes" else "no"}"
-        "--enable-vidmode=${if withVidmode then "yes" else "no"}"
-        "--enable-quartz=${if withQuartz then "yes" else "no"}"
-        "--enable-corelocation=${if withCoreLocation then "yes" else "no"}"
+        "--enable-randr=${lib.boolToYesNo withRandr}"
+        "--enable-geoclue2=${lib.boolToYesNo withGeoclue}"
+        "--enable-drm=${lib.boolToYesNo withDrm}"
+        "--enable-vidmode=${lib.boolToYesNo withVidmode}"
+        "--enable-quartz=${lib.boolToYesNo withQuartz}"
+        "--enable-corelocation=${lib.boolToYesNo withCoreLocation}"
       ]
       ++ lib.optionals (pname == "gammastep") [
         "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user/"

pkgs/applications/networking/compactor/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   asciidoctor,
   autoreconfHook,
   pkg-config,
@@ -42,6 +43,12 @@ stdenv.mkDerivation rec {
 
     # https://github.com/dns-stats/compactor/pull/91
     ./patches/update-golden-cbor2diag-output.patch
+
+    # https://github.com/dns-stats/compactor/commit/f7deaf89f55a12c586b6662a3a7d04b10a4c7bcb
+    (fetchpatch {
+      url = "https://github.com/dns-stats/compactor/commit/f7deaf89f55a12c586b6662a3a7d04b10a4c7bcb.patch";
+      hash = "sha256-eEaVS5rfrLkRGc668PwVfb/xw3n1SoCm30xEf1NjbeY=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -25,6 +25,7 @@
   libpcap,
   libsmi,
   libssh,
+  libxml2,
   lua5_4,
   lz4,
   makeWrapper,
@@ -56,7 +57,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.4.9";
+  version = "4.6.0";
 
   outputs = [
     "out"
@@ -67,7 +68,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-0+uPXSNabsYNGn+4753WNoUBe9lJ2EH3i3J36lqI4Ak=";
+    hash = "sha256-XkHcVN3xCYwnS69nJ4/AT76Iaggt1GXA6JWi+IG15IM=";
   };
 
   patches = [
@@ -111,6 +112,7 @@ stdenv.mkDerivation rec {
     libpcap
     libsmi
     libssh
+    libxml2
     lua5_4
     lz4
     minizip

pkgs/applications/science/math/caffe/cmake-minimum-required.patch

@@ -0,0 +1,10 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 08f56a33..c5291fd7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.7)
++cmake_minimum_required(VERSION 3.10)
+ if(POLICY CMP0046)
+   cmake_policy(SET CMP0046 NEW)
+ endif()

pkgs/applications/science/math/caffe/default.nix

@@ -112,9 +112,11 @@ stdenv.mkDerivation rec {
   propagatedBuildOutputs = [ ]; # otherwise propagates out -> bin cycle
 
   patches = [
+    ./cmake-minimum-required.patch
     ./darwin.patch
     ./glog-cmake.patch
     ./random-shuffle.patch
+    ./random-shuffle-includes.patch
     (fetchpatch {
       name = "support-opencv4";
       url = "https://github.com/BVLC/caffe/pull/6638/commits/0a04cc2ccd37ba36843c18fea2d5cbae6e7dd2b5.patch";

pkgs/applications/science/math/caffe/random-shuffle-includes.patch

@@ -0,0 +1,14 @@
+diff --git a/src/caffe/layers/hdf5_data_layer.cpp b/src/caffe/layers/hdf5_data_layer.cpp
+index 01213691..f42e7bea 100644
+--- a/src/caffe/layers/hdf5_data_layer.cpp
++++ b/src/caffe/layers/hdf5_data_layer.cpp
+@@ -6,7 +6,9 @@ TODO:
+   :: don't forget to update hdf5_daa_layer.cu accordingly
+ - add ability to shuffle filenames if flag is set
+ */
++#include <algorithm>
+ #include <fstream>  // NOLINT(readability/streams)
++#include <random>
+ #include <string>
+ #include <vector>
+ 

pkgs/build-support/fetchgit/default.nix

@@ -23,181 +23,200 @@ let
 in
 
 lib.makeOverridable (
-  lib.fetchers.withNormalizedHash { } (
-    # NOTE Please document parameter additions or changes in
-    #   ../../../doc/build-helpers/fetchers.chapter.md
-    {
-      url,
-      tag ? null,
-      rev ? null,
-      name ? urlToName {
-        inherit url;
-        rev = lib.revOrTag rev tag;
-        # when rootDir is specified, avoid invalidating the result when rev changes
-        append = if rootDir != "" then "-${lib.strings.sanitizeDerivationName rootDir}" else "";
-      },
-      leaveDotGit ? deepClone || fetchTags,
-      outputHash ? lib.fakeHash,
-      outputHashAlgo ? null,
-      fetchSubmodules ? true,
-      deepClone ? false,
-      branchName ? null,
-      sparseCheckout ? lib.optional (rootDir != "") rootDir,
-      nonConeMode ? rootDir != "",
-      nativeBuildInputs ? [ ],
-      # Shell code executed before the file has been fetched.  This, in
-      # particular, can do things like set NIX_PREFETCH_GIT_CHECKOUT_HOOK to
-      # run operations between the checkout completing and deleting the .git
-      # directory.
-      preFetch ? "",
-      # Shell code executed after the file has been fetched
-      # successfully. This can do things like check or transform the file.
-      postFetch ? "",
-      preferLocalBuild ? true,
-      fetchLFS ? false,
-      # Shell code to build a netrc file for BASIC auth
-      netrcPhase ? null,
-      # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
-      # needed for netrcPhase
-      netrcImpureEnvVars ? [ ],
-      passthru ? { },
-      meta ? { },
-      allowedRequisites ? null,
-      # fetch all tags after tree (useful for git describe)
-      fetchTags ? false,
-      # make this subdirectory the root of the result
-      rootDir ? "",
-      # GIT_CONFIG_GLOBAL (as a file)
-      gitConfigFile ? config.gitConfigFile,
-    }:
+  lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
 
-    /*
-      NOTE:
-      fetchgit has one problem: git fetch only works for refs.
-      This is because fetching arbitrary (maybe dangling) commits creates garbage collection risks
-      and checking whether a commit belongs to a ref is expensive. This may
-      change in the future when some caching is added to git (?)
-      Usually refs are either tags (refs/tags/*) or branches (refs/heads/*)
-      Cloning branches will make the hash check fail when there is an update.
-      But not all patches we want can be accessed by tags.
+    excludeDrvArgNames = [
+      # Passed via `passthru`
+      "tag"
 
-      The workaround is getting the last n commits so that it's likely that they
-      still contain the hash we want.
+      # Hashes, handled by `lib.fetchers.withNormalizedHash`
+      # whose outputs contain outputHash* attributes.
+      "hash"
+      "sha256"
+    ];
 
-      for now : increase depth iteratively (TODO)
+    extendDrvArgs =
+      finalAttrs:
+      lib.fetchers.withNormalizedHash { } (
+        # NOTE Please document parameter additions or changes in
+        #   ../../../doc/build-helpers/fetchers.chapter.md
+        {
+          url,
+          tag ? null,
+          rev ? null,
+          name ? urlToName {
+            inherit url;
+            rev = lib.revOrTag rev tag;
+            # when rootDir is specified, avoid invalidating the result when rev changes
+            append = if rootDir != "" then "-${lib.strings.sanitizeDerivationName rootDir}" else "";
+          },
+          leaveDotGit ? deepClone || fetchTags,
+          outputHash ? lib.fakeHash,
+          outputHashAlgo ? null,
+          fetchSubmodules ? true,
+          deepClone ? false,
+          branchName ? null,
+          sparseCheckout ? lib.optional (rootDir != "") rootDir,
+          nonConeMode ? rootDir != "",
+          nativeBuildInputs ? [ ],
+          # Shell code executed before the file has been fetched.  This, in
+          # particular, can do things like set NIX_PREFETCH_GIT_CHECKOUT_HOOK to
+          # run operations between the checkout completing and deleting the .git
+          # directory.
+          preFetch ? "",
+          # Shell code executed after the file has been fetched
+          # successfully. This can do things like check or transform the file.
+          postFetch ? "",
+          preferLocalBuild ? true,
+          fetchLFS ? false,
+          # Shell code to build a netrc file for BASIC auth
+          netrcPhase ? null,
+          # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
+          # needed for netrcPhase
+          netrcImpureEnvVars ? [ ],
+          passthru ? { },
+          meta ? { },
+          allowedRequisites ? null,
+          # fetch all tags after tree (useful for git describe)
+          fetchTags ? false,
+          # make this subdirectory the root of the result
+          rootDir ? "",
+          # GIT_CONFIG_GLOBAL (as a file)
+          gitConfigFile ? config.gitConfigFile,
+        }:
 
-      real fix: ask git folks to add a
-      git fetch $HASH contained in $BRANCH
-      facility because checking that $HASH is contained in $BRANCH is less
-      expensive than fetching --depth $N.
-      Even if git folks implemented this feature soon it may take years until
-      server admins start using the new version?
-    */
+        /*
+          NOTE:
+          fetchgit has one problem: git fetch only works for refs.
+          This is because fetching arbitrary (maybe dangling) commits creates garbage collection risks
+          and checking whether a commit belongs to a ref is expensive. This may
+          change in the future when some caching is added to git (?)
+          Usually refs are either tags (refs/tags/*) or branches (refs/heads/*)
+          Cloning branches will make the hash check fail when there is an update.
+          But not all patches we want can be accessed by tags.
 
-    assert nonConeMode -> (sparseCheckout != [ ]);
-    assert fetchTags -> leaveDotGit;
-    assert rootDir != "" -> !leaveDotGit;
+          The workaround is getting the last n commits so that it's likely that they
+          still contain the hash we want.
+
+          for now : increase depth iteratively (TODO)
+
+          real fix: ask git folks to add a
+          git fetch $HASH contained in $BRANCH
+          facility because checking that $HASH is contained in $BRANCH is less
+          expensive than fetching --depth $N.
+          Even if git folks implemented this feature soon it may take years until
+          server admins start using the new version?
+        */
+
+        assert nonConeMode -> (sparseCheckout != [ ]);
+        assert fetchTags -> leaveDotGit;
+        assert rootDir != "" -> !leaveDotGit;
 
-    let
-      revWithTag =
         let
-          warningMsg = "fetchgit requires one of either `rev` or `tag` to be provided (not both).";
-          otherIsNull = other: lib.assertMsg (other == null) warningMsg;
+          revWithTag =
+            let
+              warningMsg = "fetchgit requires one of either `rev` or `tag` to be provided (not both).";
+              otherIsNull = other: lib.assertMsg (other == null) warningMsg;
+            in
+            if tag != null then
+              assert (otherIsNull rev);
+              "refs/tags/${tag}"
+            else if rev != null then
+              assert (otherIsNull tag);
+              rev
+            else
+              # FIXME fetching HEAD if no rev or tag is provided is problematic at best
+              "HEAD";
         in
-        if tag != null then
-          assert (otherIsNull rev);
-          "refs/tags/${tag}"
-        else if rev != null then
-          assert (otherIsNull tag);
-          rev
+
+        if builtins.isString sparseCheckout then
+          # Changed to throw on 2023-06-04
+          throw
+            "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
         else
-          # FIXME fetching HEAD if no rev or tag is provided is problematic at best
-          "HEAD";
-    in
+          {
+            inherit name;
 
-    if builtins.isString sparseCheckout then
-      # Changed to throw on 2023-06-04
-      throw
-        "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."
-    else
-      stdenvNoCC.mkDerivation {
-        inherit name;
+            builder = ./builder.sh;
+            fetcher = ./nix-prefetch-git;
 
-        builder = ./builder.sh;
-        fetcher = ./nix-prefetch-git;
+            nativeBuildInputs = [
+              git
+              cacert
+            ]
+            ++ lib.optionals fetchLFS [ git-lfs ]
+            ++ nativeBuildInputs;
 
-        nativeBuildInputs = [
-          git
-          cacert
-        ]
-        ++ lib.optionals fetchLFS [ git-lfs ]
-        ++ nativeBuildInputs;
+            inherit outputHash outputHashAlgo;
+            outputHashMode = "recursive";
 
-        inherit outputHash outputHashAlgo;
-        outputHashMode = "recursive";
+            # git-sparse-checkout(1) says:
+            # > When the --stdin option is provided, the directories or patterns are read
+            # > from standard in as a newline-delimited list instead of from the arguments.
+            sparseCheckout = builtins.concatStringsSep "\n" sparseCheckout;
 
-        # git-sparse-checkout(1) says:
-        # > When the --stdin option is provided, the directories or patterns are read
-        # > from standard in as a newline-delimited list instead of from the arguments.
-        sparseCheckout = builtins.concatStringsSep "\n" sparseCheckout;
+            inherit
+              url
+              leaveDotGit
+              fetchLFS
+              fetchSubmodules
+              deepClone
+              branchName
+              nonConeMode
+              preFetch
+              postFetch
+              fetchTags
+              rootDir
+              gitConfigFile
+              ;
+            rev = revWithTag;
 
-        inherit
-          url
-          leaveDotGit
-          fetchLFS
-          fetchSubmodules
-          deepClone
-          branchName
-          nonConeMode
-          preFetch
-          postFetch
-          fetchTags
-          rootDir
-          gitConfigFile
-          ;
-        rev = revWithTag;
+            postHook =
+              if netrcPhase == null then
+                null
+              else
+                ''
+                  ${netrcPhase}
+                  # required that git uses the netrc file
+                  mv {,.}netrc
+                  export NETRC=$PWD/.netrc
+                  export HOME=$PWD
+                '';
 
-        postHook =
-          if netrcPhase == null then
-            null
-          else
-            ''
-              ${netrcPhase}
-              # required that git uses the netrc file
-              mv {,.}netrc
-              export NETRC=$PWD/.netrc
-              export HOME=$PWD
-            '';
+            impureEnvVars =
+              lib.fetchers.proxyImpureEnvVars
+              ++ netrcImpureEnvVars
+              ++ [
+                "GIT_PROXY_COMMAND"
+                "NIX_GIT_SSL_CAINFO"
+                "SOCKS_SERVER"
 
-        impureEnvVars =
-          lib.fetchers.proxyImpureEnvVars
-          ++ netrcImpureEnvVars
-          ++ [
-            "GIT_PROXY_COMMAND"
-            "NIX_GIT_SSL_CAINFO"
-            "SOCKS_SERVER"
+                # This is a parameter intended to be set by setup hooks or preFetch
+                # scripts that want per-URL control over HTTP proxies used by Git
+                # (if per-URL control isn't needed, `http_proxy` etc. will
+                # suffice). It must be a whitespace-separated (with backslash as an
+                # escape character) list of pairs like this:
+                #
+                #   http://domain1/path1 proxy1 https://domain2/path2 proxy2
+                #
+                # where the URLs are as documented in the `git-config` manual page
+                # under `http.<url>.*`, and the proxies are as documented on the
+                # same page under `http.proxy`.
+                "FETCHGIT_HTTP_PROXIES"
+              ];
 
-            # This is a parameter intended to be set by setup hooks or preFetch
-            # scripts that want per-URL control over HTTP proxies used by Git
-            # (if per-URL control isn't needed, `http_proxy` etc. will
-            # suffice). It must be a whitespace-separated (with backslash as an
-            # escape character) list of pairs like this:
-            #
-            #   http://domain1/path1 proxy1 https://domain2/path2 proxy2
-            #
-            # where the URLs are as documented in the `git-config` manual page
-            # under `http.<url>.*`, and the proxies are as documented on the
-            # same page under `http.proxy`.
-            "FETCHGIT_HTTP_PROXIES"
-          ];
+            inherit preferLocalBuild meta allowedRequisites;
 
-        inherit preferLocalBuild meta allowedRequisites;
+            passthru = {
+              gitRepoUrl = url;
+              inherit tag;
+            }
+            // passthru;
+          }
+      );
 
-        passthru = {
-          gitRepoUrl = url;
-          inherit tag;
-        }
-        // passthru;
-      }
-  )
+    # No ellipsis.
+    inheritFunctionArgs = false;
+  }
 )

pkgs/build-support/fetchurl/default.nix

@@ -53,252 +53,273 @@ let
 
 in
 
-{
-  # URL to fetch.
-  url ? "",
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
 
-  # Alternatively, a list of URLs specifying alternative download
-  # locations.  They are tried in order.
-  urls ? [ ],
+  excludeDrvArgNames = [
+    # Passed via passthru
+    "url"
 
-  # Additional curl options needed for the download to succeed.
-  # Warning: Each space (no matter the escaping) will start a new argument.
-  # If you wish to pass arguments with spaces, use `curlOptsList`
-  curlOpts ? "",
+    # Hash attributes will be map to the corresponding outputHash*
+    "hash"
+    "sha1"
+    "sha256"
+    "sha512"
+  ];
 
-  # Additional curl options needed for the download to succeed.
-  curlOptsList ? [ ],
+  extendDrvArgs =
+    finalAttrs:
+    {
+      # URL to fetch.
+      url ? "",
 
-  # Name of the file.  If empty, use the basename of `url' (or of the
-  # first element of `urls').
-  name ? "",
+      # Alternatively, a list of URLs specifying alternative download
+      # locations.  They are tried in order.
+      urls ? [ ],
 
-  # for versioned downloads optionally take pname + version.
-  pname ? "",
-  version ? "",
+      # Additional curl options needed for the download to succeed.
+      # Warning: Each space (no matter the escaping) will start a new argument.
+      # If you wish to pass arguments with spaces, use `curlOptsList`
+      curlOpts ? "",
 
-  # SRI hash.
-  hash ? "",
+      # Additional curl options needed for the download to succeed.
+      curlOptsList ? [ ],
 
-  # Legacy ways of specifying the hash.
-  outputHash ? "",
-  outputHashAlgo ? "",
-  sha1 ? "",
-  sha256 ? "",
-  sha512 ? "",
+      # Name of the file when pname + version is unspecified.
+      # Default to the basename of `url' (or of the first element of `urls').
+      name ? null,
 
-  recursiveHash ? false,
+      # for versioned downloads optionally take pname + version.
+      pname ? null,
+      version ? null,
 
-  # Shell code to build a netrc file for BASIC auth
-  netrcPhase ? null,
+      # SRI hash.
+      hash ? "",
 
-  # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
-  # needed for netrcPhase
-  netrcImpureEnvVars ? [ ],
+      # Legacy ways of specifying the hash.
+      outputHash ? "",
+      outputHashAlgo ? "",
+      sha1 ? "",
+      sha256 ? "",
+      sha512 ? "",
 
-  # Shell code executed after the file has been fetched
-  # successfully. This can do things like check or transform the file.
-  postFetch ? "",
+      recursiveHash ? false,
 
-  # Whether to download to a temporary path rather than $out. Useful
-  # in conjunction with postFetch. The location of the temporary file
-  # is communicated to postFetch via $downloadedFile.
-  downloadToTemp ? false,
+      # Shell code to build a netrc file for BASIC auth
+      netrcPhase ? null,
 
-  # If true, set executable bit on downloaded file
-  executable ? false,
+      # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
+      # needed for netrcPhase
+      netrcImpureEnvVars ? [ ],
 
-  # If set, don't download the file, but write a list of all possible
-  # URLs (resulting from resolving mirror:// URLs) to $out.
-  showURLs ? false,
+      # Shell code executed after the file has been fetched
+      # successfully. This can do things like check or transform the file.
+      postFetch ? "",
 
-  # Meta information, if any.
-  meta ? { },
+      # Whether to download to a temporary path rather than $out. Useful
+      # in conjunction with postFetch. The location of the temporary file
+      # is communicated to postFetch via $downloadedFile.
+      downloadToTemp ? false,
 
-  # Passthru information, if any.
-  passthru ? { },
-  # Doing the download on a remote machine just duplicates network
-  # traffic, so don't do that by default
-  preferLocalBuild ? true,
+      # If true, set executable bit on downloaded file
+      executable ? false,
 
-  # Additional packages needed as part of a fetch
-  nativeBuildInputs ? [ ],
-}@args:
+      # If set, don't download the file, but write a list of all possible
+      # URLs (resulting from resolving mirror:// URLs) to $out.
+      showURLs ? false,
 
-let
-  preRewriteUrls =
-    if urls != [ ] && url == "" then
-      (
-        if lib.isList urls then urls else throw "`urls` is not a list: ${lib.generators.toPretty { } urls}"
-      )
-    else if urls == [ ] && url != "" then
-      (
-        if lib.isString url then
-          [ url ]
-        else
-          throw "`url` is not a string: ${lib.generators.toPretty { } urls}"
-      )
-    else
-      throw "fetchurl requires either `url` or `urls` to be set: ${lib.generators.toPretty { } args}";
+      # Meta information, if any.
+      meta ? { },
+
+      # Passthru information, if any.
+      passthru ? { },
+      # Doing the download on a remote machine just duplicates network
+      # traffic, so don't do that by default
+      preferLocalBuild ? true,
+
+      # Additional packages needed as part of a fetch
+      nativeBuildInputs ? [ ],
+    }@args:
 
-  urls_ =
     let
-      u = lib.lists.filter (url: lib.isString url) (map rewriteURL preRewriteUrls);
-    in
-    if u == [ ] then throw "urls is empty after rewriteURL (was ${toString preRewriteUrls})" else u;
-
-  hash_ =
-    if
-      with lib.lists;
-      length (
-        filter (s: s != "") [
-          hash
-          outputHash
-          sha1
-          sha256
-          sha512
-        ]
-      ) > 1
-    then
-      throw "multiple hashes passed to fetchurl: ${lib.generators.toPretty { } urls_}"
-    else
-
-    if hash != "" then
-      {
-        outputHashAlgo = null;
-        outputHash = hash;
-      }
-    else if outputHash != "" then
-      if outputHashAlgo != "" then
-        { inherit outputHashAlgo outputHash; }
-      else
-        throw "fetchurl was passed outputHash without outputHashAlgo: ${lib.generators.toPretty { } urls_}"
-    else if sha512 != "" then
-      {
-        outputHashAlgo = "sha512";
-        outputHash = sha512;
-      }
-    else if sha256 != "" then
-      {
-        outputHashAlgo = "sha256";
-        outputHash = sha256;
-      }
-    else if sha1 != "" then
-      {
-        outputHashAlgo = "sha1";
-        outputHash = sha1;
-      }
-    else if cacert != null then
-      {
-        outputHashAlgo = "sha256";
-        outputHash = "";
-      }
-    else
-      throw "fetchurl requires a hash for fixed-output derivation: ${lib.generators.toPretty { } urls_}";
-
-  resolvedUrl =
-    let
-      mirrorSplit = lib.match "mirror://([[:alpha:]]+)/(.+)" url;
-      mirrorName = lib.head mirrorSplit;
-      mirrorList =
-        if lib.hasAttr mirrorName mirrors then
-          mirrors."${mirrorName}"
+      preRewriteUrls =
+        if urls != [ ] && url == "" then
+          (
+            if lib.isList urls then urls else throw "`urls` is not a list: ${lib.generators.toPretty { } urls}"
+          )
+        else if urls == [ ] && url != "" then
+          (
+            if lib.isString url then
+              [ url ]
+            else
+              throw "`url` is not a string: ${lib.generators.toPretty { } urls}"
+          )
         else
-          throw "unknown mirror:// site ${mirrorName}";
-    in
-    if mirrorSplit == null || mirrorName == null then
-      url
-    else
-      "${lib.head mirrorList}${lib.elemAt mirrorSplit 1}";
-in
+          throw "fetchurl requires either `url` or `urls` to be set: ${lib.generators.toPretty { } args}";
 
-assert
-  (lib.isList curlOpts)
-  -> lib.warn ''
-    fetchurl for ${toString (builtins.head urls_)}: curlOpts is a list (${
-      lib.generators.toPretty { multiline = false; } curlOpts
-    }), which is not supported anymore.
-    - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
-      curlOpts = ${lib.strings.escapeNixString (toString curlOpts)};
-    - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
-      curlOptsList = [ ${lib.concatMapStringsSep " " lib.strings.escapeNixString curlOpts} ];'' true;
+      urls_ =
+        let
+          u = lib.lists.filter (url: lib.isString url) (map rewriteURL preRewriteUrls);
+        in
+        if u == [ ] then throw "urls is empty after rewriteURL (was ${toString preRewriteUrls})" else u;
 
-stdenvNoCC.mkDerivation (
-  (
-    if (pname != "" && version != "") then
-      { inherit pname version; }
-    else
-      {
-        name =
-          if showURLs then
-            "urls"
-          else if name != "" then
-            name
+      hash_ =
+        if
+          with lib.lists;
+          length (
+            filter (s: s != "") [
+              hash
+              outputHash
+              sha1
+              sha256
+              sha512
+            ]
+          ) > 1
+        then
+          throw "multiple hashes passed to fetchurl: ${lib.generators.toPretty { } urls_}"
+        else
+
+        if hash != "" then
+          {
+            outputHashAlgo = null;
+            outputHash = hash;
+          }
+        else if outputHash != "" then
+          if outputHashAlgo != "" then
+            { inherit outputHashAlgo outputHash; }
           else
-            baseNameOf (toString (builtins.head urls_));
-      }
-  )
-  // {
-    builder = ./builder.sh;
+            throw "fetchurl was passed outputHash without outputHashAlgo: ${lib.generators.toPretty { } urls_}"
+        else if sha512 != "" then
+          {
+            outputHashAlgo = "sha512";
+            outputHash = sha512;
+          }
+        else if sha256 != "" then
+          {
+            outputHashAlgo = "sha256";
+            outputHash = sha256;
+          }
+        else if sha1 != "" then
+          {
+            outputHashAlgo = "sha1";
+            outputHash = sha1;
+          }
+        else if cacert != null then
+          {
+            outputHashAlgo = "sha256";
+            outputHash = "";
+          }
+        else
+          throw "fetchurl requires a hash for fixed-output derivation: ${lib.generators.toPretty { } urls_}";
 
-    nativeBuildInputs = [ curl ] ++ nativeBuildInputs;
+      resolvedUrl =
+        let
+          mirrorSplit = lib.match "mirror://([[:alpha:]]+)/(.+)" url;
+          mirrorName = lib.head mirrorSplit;
+          mirrorList =
+            if lib.hasAttr mirrorName mirrors then
+              mirrors."${mirrorName}"
+            else
+              throw "unknown mirror:// site ${mirrorName}";
+        in
+        if mirrorSplit == null || mirrorName == null then
+          url
+        else
+          "${lib.head mirrorList}${lib.elemAt mirrorSplit 1}";
+    in
 
-    urls = urls_;
+    {
+      name =
+        if pname != null && version != null then
+          "${finalAttrs.pname}-${finalAttrs.version}"
+        else if showURLs then
+          "urls"
+        else if name != null then
+          name
+        else
+          baseNameOf (toString (lib.head urls_));
 
-    # If set, prefer the content-addressable mirrors
-    # (http://tarballs.nixos.org) over the original URLs.
-    preferHashedMirrors = false;
+      builder = ./builder.sh;
 
-    # New-style output content requirements.
-    inherit (hash_) outputHashAlgo outputHash;
+      nativeBuildInputs = [ curl ] ++ nativeBuildInputs;
 
-    # Disable TLS verification only when we know the hash and no credentials are
-    # needed to access the resource
-    SSL_CERT_FILE =
-      if
-        (
-          hash_.outputHash == ""
-          || hash_.outputHash == lib.fakeSha256
-          || hash_.outputHash == lib.fakeSha512
-          || hash_.outputHash == lib.fakeHash
-          || netrcPhase != null
-        )
-      then
-        "${cacert}/etc/ssl/certs/ca-bundle.crt"
-      else
-        "/no-cert-file.crt";
+      urls = urls_;
 
-    outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
+      # If set, prefer the content-addressable mirrors
+      # (http://tarballs.nixos.org) over the original URLs.
+      preferHashedMirrors = false;
 
-    inherit curlOpts;
-    curlOptsList = lib.escapeShellArgs curlOptsList;
-    inherit
-      showURLs
-      mirrorsFile
-      postFetch
-      downloadToTemp
-      executable
-      ;
+      # New-style output content requirements.
+      inherit (hash_) outputHashAlgo outputHash;
 
-    impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
+      # Disable TLS verification only when we know the hash and no credentials are
+      # needed to access the resource
+      SSL_CERT_FILE =
+        if
+          (
+            hash_.outputHash == ""
+            || hash_.outputHash == lib.fakeSha256
+            || hash_.outputHash == lib.fakeSha512
+            || hash_.outputHash == lib.fakeHash
+            || netrcPhase != null
+          )
+        then
+          "${cacert}/etc/ssl/certs/ca-bundle.crt"
+        else
+          "/no-cert-file.crt";
 
-    nixpkgsVersion = lib.trivial.release;
+      outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
 
-    inherit preferLocalBuild;
-
-    postHook =
-      if netrcPhase == null then
-        null
-      else
+      curlOpts = lib.warnIf (lib.isList curlOpts) (
+        let
+          url = toString (builtins.head urls_);
+          curlOptsRepresentation = lib.generators.toPretty { multiline = false; } curlOpts;
+          curlOptsAsStringRepresentation = lib.strings.escapeNixString (toString curlOpts);
+          curlOptsListElementsRepresentation =
+            lib.concatMapStringsSep " " lib.strings.escapeNixString
+              curlOpts;
+        in
         ''
-          ${netrcPhase}
-          curlOpts="$curlOpts --netrc-file $PWD/netrc"
-        '';
+          fetchurl for ${url}: curlOpts is a list (${curlOptsRepresentation}), which is not supported anymore.
+          - If you wish to get the same effect as before, for elements with spaces (even if escaped) to expand to multiple curl arguments, use a string argument instead:
+            curlOpts = ${curlOptsAsStringRepresentation};
+          - If you wish for each list element to be passed as a separate curl argument, allowing arguments to contain spaces, use curlOptsList instead:
+            curlOptsList = [ ${curlOptsListElementsRepresentation} ];
+        ''
+      ) curlOpts;
 
-    inherit meta;
-    passthru = {
-      inherit url resolvedUrl;
-    }
-    // passthru;
-  }
-)
+      curlOptsList = lib.escapeShellArgs curlOptsList;
+
+      inherit
+        showURLs
+        mirrorsFile
+        postFetch
+        downloadToTemp
+        executable
+        ;
+
+      impureEnvVars = impureEnvVars ++ netrcImpureEnvVars;
+
+      nixpkgsVersion = lib.trivial.release;
+
+      inherit preferLocalBuild;
+
+      postHook =
+        if netrcPhase == null then
+          null
+        else
+          ''
+            ${netrcPhase}
+            curlOpts="$curlOpts --netrc-file $PWD/netrc"
+          '';
+
+      inherit meta;
+      passthru = {
+        inherit url resolvedUrl;
+      }
+      // passthru;
+    };
+
+  # No ellipsis
+  inheritFunctionArgs = false;
+}

pkgs/build-support/fetchzip/default.nix

@@ -14,96 +14,100 @@
   glibcLocalesUtf8,
 }:
 
-{
-  url ? "",
-  urls ? [ ],
-  name ? repoRevToNameMaybe (if url != "" then url else builtins.head urls) null "unpacked",
-  nativeBuildInputs ? [ ],
-  postFetch ? "",
-  extraPostFetch ? "",
+lib.extendMkDerivation {
+  constructDrv = fetchurl;
 
-  # Optionally move the contents of the unpacked tree up one level.
-  stripRoot ? true,
-  # Allows to set the extension for the intermediate downloaded
-  # file. This can be used as a hint for the unpackCmdHooks to select
-  # an appropriate unpacking tool.
-  extension ? null,
-
-  # the rest are given to fetchurl as is
-  ...
-}@args:
-
-assert
-  (extraPostFetch != "")
-  -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'." true;
-
-let
-  tmpFilename =
-    if extension != null then
-      "download.${extension}"
-    else
-      baseNameOf (if url != "" then url else builtins.head urls);
-in
-
-fetchurl (
-  {
-    inherit name;
-    recursiveHash = true;
-
-    downloadToTemp = true;
-
-    # Have to pull in glibcLocalesUtf8 for unzip in setup-hook.sh to handle
-    # UTF-8 aware locale:
-    #   https://github.com/NixOS/nixpkgs/issues/176225#issuecomment-1146617263
-    nativeBuildInputs =
-      lib.optionals withUnzip [
-        unzip
-        glibcLocalesUtf8
-      ]
-      ++ nativeBuildInputs;
-
-    postFetch = ''
-      unpackDir="$TMPDIR/unpack"
-      mkdir "$unpackDir"
-      cd "$unpackDir"
-
-      renamed="$TMPDIR/${tmpFilename}"
-      mv "$downloadedFile" "$renamed"
-      unpackFile "$renamed"
-      chmod -R +w "$unpackDir"
-    ''
-    + (
-      if stripRoot then
-        ''
-          if [ $(ls -A "$unpackDir" | wc -l) != 1 ]; then
-            echo "error: zip file must contain a single file or directory."
-            echo "hint: Pass stripRoot=false; to fetchzip to assume flat list of files."
-            exit 1
-          fi
-          fn=$(cd "$unpackDir" && ls -A)
-          if [ -f "$unpackDir/$fn" ]; then
-            mkdir $out
-          fi
-          mv "$unpackDir/$fn" "$out"
-        ''
-      else
-        ''
-          mv "$unpackDir" "$out"
-        ''
-    )
-    + ''
-      ${postFetch}
-      ${extraPostFetch}
-      chmod 755 "$out"
-    '';
-    # ^ Remove non-owner write permissions
-    # Fixes https://github.com/NixOS/nixpkgs/issues/38649
-  }
-  // removeAttrs args [
-    "stripRoot"
+  excludeDrvArgNames = [
     "extraPostFetch"
-    "postFetch"
+
+    # TODO(@ShamrockLee): Move these arguments to derivationArgs when available.
     "extension"
-    "nativeBuildInputs"
-  ]
-)
+    "stripRoot"
+  ];
+
+  extendDrvArgs =
+    finalAttrs:
+    {
+      url ? "",
+      urls ? [ ],
+      name ? repoRevToNameMaybe (if url != "" then url else builtins.head urls) null "unpacked",
+      nativeBuildInputs ? [ ],
+      postFetch ? "",
+      extraPostFetch ? "",
+
+      # Optionally move the contents of the unpacked tree up one level.
+      stripRoot ? true,
+      # Allows to set the extension for the intermediate downloaded
+      # file. This can be used as a hint for the unpackCmdHooks to select
+      # an appropriate unpacking tool.
+      extension ? null,
+
+      # the rest are given to fetchurl as is
+      ...
+    }@args:
+
+    let
+      tmpFilename =
+        if extension != null then
+          "download.${extension}"
+        else
+          baseNameOf (if url != "" then url else builtins.head urls);
+    in
+
+    {
+      inherit name;
+      recursiveHash = true;
+
+      downloadToTemp = true;
+
+      # Have to pull in glibcLocalesUtf8 for unzip in setup-hook.sh to handle
+      # UTF-8 aware locale:
+      #   https://github.com/NixOS/nixpkgs/issues/176225#issuecomment-1146617263
+      nativeBuildInputs =
+        lib.optionals withUnzip [
+          unzip
+          glibcLocalesUtf8
+        ]
+        ++ nativeBuildInputs;
+
+      postFetch = ''
+        unpackDir="$TMPDIR/unpack"
+        mkdir "$unpackDir"
+        cd "$unpackDir"
+
+        renamed="$TMPDIR/${tmpFilename}"
+        mv "$downloadedFile" "$renamed"
+        unpackFile "$renamed"
+        chmod -R +w "$unpackDir"
+      ''
+      + (
+        if stripRoot then
+          ''
+            if [ $(ls -A "$unpackDir" | wc -l) != 1 ]; then
+              echo "error: zip file must contain a single file or directory."
+              echo "hint: Pass stripRoot=false; to fetchzip to assume flat list of files."
+              exit 1
+            fi
+            fn=$(cd "$unpackDir" && ls -A)
+            if [ -f "$unpackDir/$fn" ]; then
+              mkdir $out
+            fi
+            mv "$unpackDir/$fn" "$out"
+          ''
+        else
+          ''
+            mv "$unpackDir" "$out"
+          ''
+      )
+      + ''
+        ${postFetch}
+        ${lib.warnIf (extraPostFetch != "")
+          "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'."
+          extraPostFetch
+        }
+        chmod 755 "$out"
+      '';
+      # ^ Remove non-owner write permissions
+      # Fixes https://github.com/NixOS/nixpkgs/issues/38649
+    };
+}

pkgs/build-support/release/debian-build.nix

@@ -69,7 +69,7 @@ vmTools.runInLinuxImage (
           # the log file
           export PAGER=cat
           ${checkinstall}/sbin/checkinstall --nodoc -y -D \
-            --fstrans=${if fsTranslation then "yes" else "no"} \
+            --fstrans=${lib.boolToYesNo fsTranslation} \
             --requires="${lib.concatStringsSep "," debRequires}" \
             --provides="${lib.concatStringsSep "," debProvides}" \
             ${

pkgs/by-name/ac/activemq/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "6.1.7";
+  version = "6.1.8";
 in
 stdenvNoCC.mkDerivation {
   pname = "activemq";
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchurl {
     url = "mirror://apache/activemq/${version}/apache-activemq-${version}-bin.tar.gz";
-    hash = "sha256-dcxBEJqJd0XUSsonNYVo88vgzVj8a7/wNag8Td9I0xY=";
+    hash = "sha256-BCrdMR698xAsl+8nY8DpwdZZH6LH2C5FBNZ2sRUmtBk=";
   };
 
   installPhase = ''

pkgs/by-name/ap/apr/package.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       # These answers are valid on x86_64-linux and aarch64-linux.
       # TODO: provide all valid answers for BSD.
       "ac_cv_file__dev_zero=yes"
-      "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
+      "ac_cv_func_setpgrp_void=${lib.boolToYesNo (!stdenv.hostPlatform.isBSD)}"
       "apr_cv_tcp_nodelay_with_cork=yes"
       "ac_cv_define_PTHREAD_PROCESS_SHARED=yes"
       "apr_cv_process_shared_works=yes"

pkgs/by-name/as/async-profiler/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "async-profiler";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "jvm-profiling-tools";
     repo = "async-profiler";
     rev = "v${version}";
-    hash = "sha256-82aZK9y1Y5PaYtIG7FqnrbYU+bQ3nNzOCn+3lFzyeCA=";
+    hash = "sha256-y/MQgXoaJSwc6QjTPGQRFNyVoR1ENQ7rDmtCwR5F/oM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/au/auto-editor/lock.json

@@ -0,0 +1,28 @@
+{
+  "depends": [
+    {
+      "method": "fetchzip",
+      "path": "/nix/store/w556rbsnv2fxb229av2iq180ri9x0d9j-source",
+      "rev": "77469f58916369bc3863194cabb05238577fb257",
+      "sha256": "18wjz5yqzr1dz6286p2w02fk2xjr54l477g90bz4pskjcqrqnjbv",
+      "url": "https://github.com/khchen/tinyre/archive/77469f58916369bc3863194cabb05238577fb257.tar.gz",
+      "ref": "1.6.0",
+      "packages": [
+        "tinyre"
+      ],
+      "srcDir": ""
+    },
+    {
+      "method": "fetchzip",
+      "path": "/nix/store/6aph9sfwcws7pd2725fwjnibdfrv7qmw-source",
+      "rev": "f8f6bd34bfa3fe12c64b919059ad856a96efcba0",
+      "sha256": "11m1rb6rzk70kvskppf97ddzgf5fnh9crjziqc6hib0jgsm5d615",
+      "url": "https://github.com/nim-lang/checksums/archive/f8f6bd34bfa3fe12c64b919059ad856a96efcba0.tar.gz",
+      "ref": "v0.2.1",
+      "packages": [
+        "checksums"
+      ],
+      "srcDir": "src"
+    }
+  ]
+}

pkgs/by-name/au/auto-editor/package.nix

@@ -1,43 +1,100 @@
 {
   lib,
-  python3Packages,
+  buildNimPackage,
   fetchFromGitHub,
+
+  withHEVC ? true,
+  withWhisper ? false,
+
+  ffmpeg,
   yt-dlp,
+  lame,
+  libopus,
+  libvpx,
+  x264,
+  x265,
+  dav1d,
+  svt-av1,
+  whisper-cpp,
+
+  python3,
+  python3Packages,
+  nimble,
+  nim,
 }:
 
-python3Packages.buildPythonApplication rec {
+buildNimPackage rec {
   pname = "auto-editor";
-  version = "28.0.2";
-  pyproject = true;
+  version = "29.2.0";
 
   src = fetchFromGitHub {
     owner = "WyattBlue";
     repo = "auto-editor";
     tag = version;
-    hash = "sha256-ozw5ZPvKP7aTBBItQKNx85hZ1T4IxX9NYCcNHC5UuuM=";
+    hash = "sha256-2EpdrFGkeISiCnwtBMFikfWOzEdHO/ut2NbVbIAutdk=";
   };
 
-  postPatch = ''
-    substituteInPlace auto_editor/__main__.py \
-      --replace-fail '"yt-dlp"' '"${lib.getExe yt-dlp}"'
-  '';
+  lockFile = ./lock.json;
 
-  build-system = with python3Packages; [ setuptools ];
-
-  dependencies = with python3Packages; [
-    basswood-av
-    numpy
+  buildInputs = [
+    ffmpeg
+    lame
+    libopus
+    libvpx
+    x264
+    dav1d
+    svt-av1
+  ]
+  ++ lib.optionals withHEVC [
+    x265
+  ]
+  ++ lib.optionals withWhisper [
+    whisper-cpp
   ];
 
-  checkPhase = ''
-    runHook preCheck
+  nimFlags = [
+    "--passc:-Wno-incompatible-pointer-types"
+  ]
+  ++ lib.optionals withHEVC [
+    "-d:enable_hevc"
+  ]
+  ++ lib.optionals withWhisper [
+    "-d:enable_whisper"
+  ];
 
-    $out/bin/auto-editor test all
+  postPatch = ''
+    substituteInPlace src/log.nim \
+      --replace-fail '"yt-dlp"' '"${lib.getExe yt-dlp}"'
 
-    runHook postCheck
+    # buildNimPackage hack
+    substituteInPlace ae.nimble \
+      --replace-fail '"main=auto-editor"' '"main"'
   '';
 
-  pythonImportsCheck = [ "auto_editor" ];
+  # TODO: Fix checks
+  /*
+    nativeCheckInputs = [
+      python3Packages.av
+      python3
+    ];
+
+    checkPhase = ''
+      runHook preCheck
+
+      nim c \
+      ${if withHEVC then "-d:enable_hevc" else ""} \
+      ${if withWhisper then "-d:enable_whisper" else ""} \
+      -r $src/src/rationals
+
+      python3 $src/tests/test.py
+
+      runHook postCheck
+    '';
+  */
+
+  postInstall = ''
+    mv $out/bin/main $out/bin/auto-editor
+  '';
 
   meta = {
     changelog = "https://github.com/WyattBlue/auto-editor/releases/tag/${src.tag}";
@@ -45,6 +102,10 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://auto-editor.com/";
     license = lib.licenses.unlicense;
     mainProgram = "auto-editor";
-    maintainers = with lib.maintainers; [ tomasajt ];
+    maintainers = with lib.maintainers; [
+      tomasajt
+      utopiatopia
+    ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/ba/bacula/package.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   ]
   ++
     lib.optional (stdenv.buildPlatform != stdenv.hostPlatform)
-      "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
+      "ac_cv_func_setpgrp_void=${lib.boolToYesNo (!stdenv.hostPlatform.isBSD)}"
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # bacula’s `configure` script fails to detect CoreFoundation correctly,
     # but these symbols are available in the nixpkgs CoreFoundation framework.

pkgs/by-name/bi/bicpl/package.nix

@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation {
   pname = "bicpl";
-  version = "unstable-2024-05-14";
+  version = "0-unstable-2025-10-24";
 
   # master is not actively maintained, using develop and develop-apple branches
   src = fetchFromGitHub {
     owner = "BIC-MNI";
     repo = "bicpl";
-    rev = "7e1e791483cf135fe29b8eecd7a360aa892823ae";
-    hash = "sha256-SvbtPUfEYp3IGivG+5yFdJF904miyMk+s15zwW7e7b4=";
+    rev = "dc9828841e38c6b7c523f3ab8a4c23eeb9e4272b";
+    hash = "sha256-wU/Qmtk6rbwxYqealV2On7W0schrYH85oKIUCpT4IXQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/bl/bluej/package.nix

@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     (makeDesktopItem {
       name = "BlueJ";
       desktopName = "BlueJ";
-      exec = "BlueJ";
+      exec = "bluej";
       icon = "bluej";
       comment = "A simple powerful Java IDE";
       categories = [

pkgs/by-name/co/colpack/package.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   configureFlags = [
-    "--enable-openmp=${if stdenv.hostPlatform.isLinux then "yes" else "no"}"
+    "--enable-openmp=${lib.boolToYesNo stdenv.hostPlatform.isLinux}"
     "--enable-examples=no"
   ];
 

pkgs/by-name/co/converseen/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "converseen";
-  version = "0.15.0.3";
+  version = "0.15.1.0";
 
   src = fetchFromGitHub {
     owner = "Faster3ck";
     repo = "Converseen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZC7D+0tonAIkbDaoqw+RarIVuNcDQe410JrfC2kG+B8=";
+    hash = "sha256-loWwwleiBgwV/6t33HgIqEHU9y/pqyocmwBn0Qg01RY=";
   };
 
   strictDeps = true;

pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix

@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage {
   meta = {
     description = "Caffeine Applet for the COSMIC desktop";
     homepage = "https://github.com/tropicbliss/cosmic-ext-applet-caffeine";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl2Only;
     mainProgram = "cosmic-ext-applet-caffeine";
     maintainers = [ lib.maintainers.HeitorAugustoLN ];
     platforms = lib.platforms.linux;

pkgs/by-name/di/distrobox/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "distrobox";
-  version = "1.8.1.2";
+  version = "1.8.2.0";
 
   src = fetchFromGitHub {
     owner = "89luca89";
     repo = "distrobox";
     rev = finalAttrs.version;
-    hash = "sha256-wTu+8SQZaf8TKkjyvKqTvIWnCZTiPnozybTu5uKXEJk=";
+    hash = "sha256-uwJD7HsWoQ/LxYL0mSSxMni676qqEnMHndpL01M5ySE=";
   };
 
   dontConfigure = true;

pkgs/by-name/do/doctoc/test-generates-valid-markdown/default.nix

@@ -1,5 +1,5 @@
-{ runCommandNoCC, doctoc }:
-runCommandNoCC "doctoc-test-generates-valid-markdown.md" { nativeBuildInputs = [ doctoc ]; } ''
+{ runCommand, doctoc }:
+runCommand "doctoc-test-generates-valid-markdown.md" { nativeBuildInputs = [ doctoc ]; } ''
   cp ${./input.md} ./target.md && chmod +w ./target.md
   doctoc ./target.md
 

pkgs/by-name/do/documenso/package-lock.json.patch

@@ -0,0 +1,789 @@
+diff --git a/package-lock.json b/package-lock.json
+index 1a647e8..d44033c 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -16,7 +16,6 @@
+         "@documenso/prisma": "^0.0.0",
+         "@lingui/conf": "^5.2.0",
+         "@lingui/core": "^5.2.0",
+-        "inngest-cli": "^0.29.1",
+         "luxon": "^3.5.0",
+         "mupdf": "^1.0.0",
+         "react": "^18",
+@@ -41,7 +40,7 @@
+         "prisma-extension-kysely": "^3.0.0",
+         "prisma-kysely": "^1.8.0",
+         "rimraf": "^5.0.1",
+-        "turbo": "^1.9.3",
++        "turbo": "^2.5.8",
+         "vite": "^6.3.5"
+       },
+       "engines": {
+@@ -13223,15 +13222,6 @@
+         "node": ">=0.4.0"
+       }
+     },
+-    "node_modules/adm-zip": {
+-      "version": "0.5.16",
+-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.16.tgz",
+-      "integrity": "sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==",
+-      "license": "MIT",
+-      "engines": {
+-        "node": ">=12.0"
+-      }
+-    },
+     "node_modules/agent-base": {
+       "version": "7.1.3",
+       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
+@@ -14705,6 +14695,7 @@
+       "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
+       "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+       "license": "ISC",
++      "optional": true,
+       "engines": {
+         "node": ">=10"
+       }
+@@ -19315,6 +19306,7 @@
+       "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
+       "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
+       "license": "ISC",
++      "optional": true,
+       "dependencies": {
+         "minipass": "^3.0.0"
+       },
+@@ -19327,6 +19319,7 @@
+       "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+       "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+       "license": "ISC",
++      "optional": true,
+       "dependencies": {
+         "yallist": "^4.0.0"
+       },
+@@ -19338,7 +19331,8 @@
+       "version": "4.0.0",
+       "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+       "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+-      "license": "ISC"
++      "license": "ISC",
++      "optional": true
+     },
+     "node_modules/fs.realpath": {
+       "version": "1.0.0",
+@@ -21227,23 +21221,6 @@
+         }
+       }
+     },
+-    "node_modules/inngest-cli": {
+-      "version": "0.29.9",
+-      "resolved": "https://registry.npmjs.org/inngest-cli/-/inngest-cli-0.29.9.tgz",
+-      "integrity": "sha512-H02T7DGG53WV38RswpWmz7JsZXajx+uXDi1Zgq/ON5a+fNQi4hVRkxfoiZLngNeROVVXlokMTBwOShdsrnr7WA==",
+-      "hasInstallScript": true,
+-      "license": "SEE LICENSE IN LICENSE.md",
+-      "dependencies": {
+-        "adm-zip": "^0.5.10",
+-        "debug": "^4.3.4",
+-        "node-fetch": "2.6.7",
+-        "tar": "6.2.1"
+-      },
+-      "bin": {
+-        "inngest": "bin/inngest",
+-        "inngest-cli": "bin/inngest"
+-      }
+-    },
+     "node_modules/inngest/node_modules/@opentelemetry/api": {
+       "version": "1.9.0",
+       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
+@@ -25470,6 +25447,7 @@
+       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
+       "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
+       "license": "MIT",
++      "optional": true,
+       "dependencies": {
+         "minipass": "^3.0.0",
+         "yallist": "^4.0.0"
+@@ -25483,6 +25461,7 @@
+       "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+       "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+       "license": "ISC",
++      "optional": true,
+       "dependencies": {
+         "yallist": "^4.0.0"
+       },
+@@ -25494,13 +25473,15 @@
+       "version": "4.0.0",
+       "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+       "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+-      "license": "ISC"
++      "license": "ISC",
++      "optional": true
+     },
+     "node_modules/mkdirp": {
+       "version": "1.0.4",
+       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+       "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+       "license": "MIT",
++      "optional": true,
+       "bin": {
+         "mkdirp": "bin/cmd.js"
+       },
+@@ -32780,6 +32761,7 @@
+       "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
+       "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+       "license": "ISC",
++      "optional": true,
+       "dependencies": {
+         "chownr": "^2.0.0",
+         "fs-minipass": "^2.0.0",
+@@ -32838,6 +32820,7 @@
+       "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
+       "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+       "license": "ISC",
++      "optional": true,
+       "engines": {
+         "node": ">=8"
+       }
+@@ -32846,7 +32829,8 @@
+       "version": "4.0.0",
+       "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+       "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+-      "license": "ISC"
++      "license": "ISC",
++      "optional": true
+     },
+     "node_modules/temp-dir": {
+       "version": "2.0.0",
+@@ -34050,102 +34034,102 @@
+       }
+     },
+     "node_modules/turbo": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo/-/turbo-1.13.4.tgz",
+-      "integrity": "sha512-1q7+9UJABuBAHrcC4Sxp5lOqYS5mvxRrwa33wpIyM18hlOCpRD/fTJNxZ0vhbMcJmz15o9kkVm743mPn7p6jpQ==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.5.8.tgz",
++      "integrity": "sha512-5c9Fdsr9qfpT3hA0EyYSFRZj1dVVsb6KIWubA9JBYZ/9ZEAijgUEae0BBR/Xl/wekt4w65/lYLTFaP3JmwSO8w==",
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "bin": {
+         "turbo": "bin/turbo"
+       },
+       "optionalDependencies": {
+-        "turbo-darwin-64": "1.13.4",
+-        "turbo-darwin-arm64": "1.13.4",
+-        "turbo-linux-64": "1.13.4",
+-        "turbo-linux-arm64": "1.13.4",
+-        "turbo-windows-64": "1.13.4",
+-        "turbo-windows-arm64": "1.13.4"
++        "turbo-darwin-64": "2.5.8",
++        "turbo-darwin-arm64": "2.5.8",
++        "turbo-linux-64": "2.5.8",
++        "turbo-linux-arm64": "2.5.8",
++        "turbo-windows-64": "2.5.8",
++        "turbo-windows-arm64": "2.5.8"
+       }
+     },
+     "node_modules/turbo-darwin-64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-darwin-64/-/turbo-darwin-64-1.13.4.tgz",
+-      "integrity": "sha512-A0eKd73R7CGnRinTiS7txkMElg+R5rKFp9HV7baDiEL4xTG1FIg/56Vm7A5RVgg8UNgG2qNnrfatJtb+dRmNdw==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-darwin-64/-/turbo-darwin-64-2.5.8.tgz",
++      "integrity": "sha512-Dh5bCACiHO8rUXZLpKw+m3FiHtAp2CkanSyJre+SInEvEr5kIxjGvCK/8MFX8SFRjQuhjtvpIvYYZJB4AGCxNQ==",
+       "cpu": [
+         "x64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "darwin"
+       ]
+     },
+     "node_modules/turbo-darwin-arm64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-darwin-arm64/-/turbo-darwin-arm64-1.13.4.tgz",
+-      "integrity": "sha512-eG769Q0NF6/Vyjsr3mKCnkG/eW6dKMBZk6dxWOdrHfrg6QgfkBUk0WUUujzdtVPiUIvsh4l46vQrNVd9EOtbyA==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-darwin-arm64/-/turbo-darwin-arm64-2.5.8.tgz",
++      "integrity": "sha512-f1H/tQC9px7+hmXn6Kx/w8Jd/FneIUnvLlcI/7RGHunxfOkKJKvsoiNzySkoHQ8uq1pJnhJ0xNGTlYM48ZaJOQ==",
+       "cpu": [
+         "arm64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "darwin"
+       ]
+     },
+     "node_modules/turbo-linux-64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-linux-64/-/turbo-linux-64-1.13.4.tgz",
+-      "integrity": "sha512-Bq0JphDeNw3XEi+Xb/e4xoKhs1DHN7OoLVUbTIQz+gazYjigVZvtwCvgrZI7eW9Xo1eOXM2zw2u1DGLLUfmGkQ==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-linux-64/-/turbo-linux-64-2.5.8.tgz",
++      "integrity": "sha512-hMyvc7w7yadBlZBGl/bnR6O+dJTx3XkTeyTTH4zEjERO6ChEs0SrN8jTFj1lueNXKIHh1SnALmy6VctKMGnWfw==",
+       "cpu": [
+         "x64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "linux"
+       ]
+     },
+     "node_modules/turbo-linux-arm64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-linux-arm64/-/turbo-linux-arm64-1.13.4.tgz",
+-      "integrity": "sha512-BJcXw1DDiHO/okYbaNdcWN6szjXyHWx9d460v6fCHY65G8CyqGU3y2uUTPK89o8lq/b2C8NK0yZD+Vp0f9VoIg==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-linux-arm64/-/turbo-linux-arm64-2.5.8.tgz",
++      "integrity": "sha512-LQELGa7bAqV2f+3rTMRPnj5G/OHAe2U+0N9BwsZvfMvHSUbsQ3bBMWdSQaYNicok7wOZcHjz2TkESn1hYK6xIQ==",
+       "cpu": [
+         "arm64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "linux"
+       ]
+     },
+     "node_modules/turbo-windows-64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-windows-64/-/turbo-windows-64-1.13.4.tgz",
+-      "integrity": "sha512-OFFhXHOFLN7A78vD/dlVuuSSVEB3s9ZBj18Tm1hk3aW1HTWTuAw0ReN6ZNlVObZUHvGy8d57OAGGxf2bT3etQw==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-windows-64/-/turbo-windows-64-2.5.8.tgz",
++      "integrity": "sha512-3YdcaW34TrN1AWwqgYL9gUqmZsMT4T7g8Y5Azz+uwwEJW+4sgcJkIi9pYFyU4ZBSjBvkfuPZkGgfStir5BBDJQ==",
+       "cpu": [
+         "x64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "win32"
+       ]
+     },
+     "node_modules/turbo-windows-arm64": {
+-      "version": "1.13.4",
+-      "resolved": "https://registry.npmjs.org/turbo-windows-arm64/-/turbo-windows-arm64-1.13.4.tgz",
+-      "integrity": "sha512-u5A+VOKHswJJmJ8o8rcilBfU5U3Y1TTAfP9wX8bFh8teYF1ghP0EhtMRLjhtp6RPa+XCxHHVA2CiC3gbh5eg5g==",
++      "version": "2.5.8",
++      "resolved": "https://registry.npmjs.org/turbo-windows-arm64/-/turbo-windows-arm64-2.5.8.tgz",
++      "integrity": "sha512-eFC5XzLmgXJfnAK3UMTmVECCwuBcORrWdewoiXBnUm934DY6QN8YowC/srhNnROMpaKaqNeRpoB5FxCww3eteQ==",
+       "cpu": [
+         "arm64"
+       ],
+       "dev": true,
+-      "license": "MPL-2.0",
++      "license": "MIT",
+       "optional": true,
+       "os": [
+         "win32"
+@@ -36114,7 +36098,9 @@
+       },
+       "engines": {
+         "node": ">=18"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.52.0.tgz",
++      "integrity": "sha512-uh6W7sb55hl7D6vsAeA+V2p5JnlAqzhqFyF0VcJkKZXkgnFcVG9PziERRHQfPLfNGx1C292a4JqbWzhR8L4R1g=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test": {
+       "version": "2.0.12",
+@@ -36136,25 +36122,33 @@
+       },
+       "engines": {
+         "node": ">=16"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.12.tgz",
++      "integrity": "sha512-U6QiS5qsz+DN5RfJJrkAXdooxMDnLZ+n5nR8kaX//ZH19SilF6b58Z3zM9zTfrNIkJepzauHo4RceSgvgUSX9w=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/bluebird": {
+       "version": "3.7.2",
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
++      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/check-more-types": {
+       "version": "2.24.0",
+       "license": "MIT",
+       "engines": {
+         "node": ">= 0.8.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/check-more-types/-/check-more-types-2.24.0.tgz",
++      "integrity": "sha512-Pj779qHxV2tuapviy1bSZNEL1maXr13bPYpsvSDB68HlYcYuhlDrmGd63i0JHMCLKzc7rUSNIrpdJlhVlNwrxA=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/lazy-ass": {
+       "version": "1.6.0",
+       "license": "MIT",
+       "engines": {
+         "node": "> 0.8"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/lazy-ass/-/lazy-ass-1.6.0.tgz",
++      "integrity": "sha512-cc8oEVoctTvsFZ/Oje/kGnHbpWHYBe8IAJe4C0QNc3t8uM/0Y8+erSz/7Y1ALuXTEZTMvxXwO6YbX1ey3ujiZw=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree": {
+       "version": "1.2.0",
+@@ -36167,7 +36161,9 @@
+       },
+       "engines": {
+         "node": ">= 0.10"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/ps-tree/-/ps-tree-1.2.0.tgz",
++      "integrity": "sha512-0VnamPPYHl4uaU/nSFeZZpR21QAWRz+sRv4iW9+v/GS/J5U5iZB5BNN6J0RMoOvdx2gWM2+ZFMIm58q24e4UYA=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream": {
+       "version": "3.3.4",
+@@ -36180,18 +36176,26 @@
+         "split": "0.3",
+         "stream-combiner": "~0.0.4",
+         "through": "~2.3.1"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz",
++      "integrity": "sha512-QHpkERcGsR0T7Qm3HNJSyXKEEj8AHNxkY3PK8TS2KJvQ7NiSHe3DDpwVKKtoYprL/AreyzFBeIkBIWChAqn60g=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/duplexer": {
+       "version": "0.1.2",
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz",
++      "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/from": {
+       "version": "0.1.7",
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/from/-/from-0.1.7.tgz",
++      "integrity": "sha512-twe20eF1OxVxp/ML/kq2p1uc6KvFK/+vs8WjEbeKmV2He22MKm7YF2ANIt+EOqhJ5L3K/SuuPhk0hWQDjOM23g=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/map-stream": {
+-      "version": "0.1.0"
++      "version": "0.1.0",
++      "resolved": "https://registry.npmjs.org/map-stream/-/map-stream-0.1.0.tgz",
++      "integrity": "sha512-CkYQrPYZfWnu/DAmVCpTSX/xHpKZ80eKh2lAkyA6AJTef6bW+6JpbQZN5rofum7da+SyN1bi5ctTm+lTfcCW3g=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/pause-stream": {
+       "version": "0.0.11",
+@@ -36201,7 +36205,9 @@
+       ],
+       "dependencies": {
+         "through": "~2.3"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/pause-stream/-/pause-stream-0.0.11.tgz",
++      "integrity": "sha512-e3FBlXLmN/D1S+zHzanP4E/4Z60oFAa3O051qt1pxa7DEJWKAyil6upYVXCWadEnuoqa4Pkc9oUx9zsxYeRv8A=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/split": {
+       "version": "0.3.3",
+@@ -36211,14 +36217,18 @@
+       },
+       "engines": {
+         "node": "*"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/split/-/split-0.3.3.tgz",
++      "integrity": "sha512-wD2AeVmxXRBoX44wAycgjVpMhvbwdI2aZjCkvfNcH1YqHQvJVa1duWc73OyVGJUc05fhFaTZeQ/PYsrmyH0JVA=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/ps-tree/node_modules/event-stream/node_modules/stream-combiner": {
+       "version": "0.0.4",
+       "license": "MIT",
+       "dependencies": {
+         "duplexer": "~0.1.1"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/stream-combiner/-/stream-combiner-0.0.4.tgz",
++      "integrity": "sha512-rT00SPnTVyRsaSz5zgSPma/aHSOic5U1prhYdRy5HS2kTZviFpmDgzilbtsJsxiroqACmayynDN/9VzIbX5DOw=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on": {
+       "version": "8.0.3",
+@@ -36235,7 +36245,9 @@
+       },
+       "engines": {
+         "node": ">=12.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-8.0.3.tgz",
++      "integrity": "sha512-nQFqAFzZDeRxsu7S3C7LbuxslHhk+gnJZHyethuGKAn2IVleIbTB9I3vJSQiSR+DifUqmdzfPMoMPJfLqMF2vw=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi": {
+       "version": "17.13.3",
+@@ -36246,40 +36258,54 @@
+         "@sideway/address": "^4.1.5",
+         "@sideway/formula": "^3.0.1",
+         "@sideway/pinpoint": "^2.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
++      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi/node_modules/@hapi/hoek": {
+       "version": "9.3.0",
+-      "license": "BSD-3-Clause"
++      "license": "BSD-3-Clause",
++      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
++      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi/node_modules/@hapi/topo": {
+       "version": "5.1.0",
+       "license": "BSD-3-Clause",
+       "dependencies": {
+         "@hapi/hoek": "^9.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
++      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi/node_modules/@sideway/address": {
+       "version": "4.1.5",
+       "license": "BSD-3-Clause",
+       "dependencies": {
+         "@hapi/hoek": "^9.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
++      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi/node_modules/@sideway/formula": {
+       "version": "3.0.1",
+-      "license": "BSD-3-Clause"
++      "license": "BSD-3-Clause",
++      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
++      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/joi/node_modules/@sideway/pinpoint": {
+       "version": "2.0.0",
+-      "license": "BSD-3-Clause"
++      "license": "BSD-3-Clause",
++      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
++      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ=="
+     },
+     "packages/app-tests/node_modules/start-server-and-test/node_modules/wait-on/node_modules/rxjs": {
+       "version": "7.8.2",
+       "license": "Apache-2.0",
+       "dependencies": {
+         "tslib": "^2.1.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
++      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA=="
+     },
+     "packages/assets": {
+       "name": "@documenso/assets",
+@@ -36718,7 +36744,9 @@
+     },
+     "packages/signing/node_modules/ts-pattern": {
+       "version": "5.7.1",
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/ts-pattern/-/ts-pattern-5.7.1.tgz",
++      "integrity": "sha512-EGs8PguQqAAUIcQfK4E9xdXxB6s2GK4sJfT/vcc9V1ELIvC4LH/zXu2t/5fajtv6oiRCxdv7BgtVK3vWgROxag=="
+     },
+     "packages/signing/node_modules/vitest": {
+       "version": "3.1.4",
+@@ -36787,7 +36815,9 @@
+         "jsdom": {
+           "optional": true
+         }
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.1.4.tgz",
++      "integrity": "sha512-Ta56rT7uWxCSJXlBtKgIlApJnT6e6IGmTYxYcmxjJ4ujuZDI59GUQgVDObXXJujOmPDBYXHK1qmaGtneu6TNIQ=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/expect": {
+       "version": "3.1.4",
+@@ -36801,7 +36831,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-3.1.4.tgz",
++      "integrity": "sha512-xkD/ljeliyaClDYqHPNCiJ0plY5YIcM0OlRiZizLhlPmpXWpxnGMyTZXOHFhFeG7w9P5PBeL4IdtJ/HeQwTbQA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/mocker": {
+       "version": "3.1.4",
+@@ -36826,7 +36858,9 @@
+         "vite": {
+           "optional": true
+         }
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.1.4.tgz",
++      "integrity": "sha512-8IJ3CvwtSw/EFXqWFL8aCMu+YyYXG2WUSrQbViOZkWTKTVicVwZ/YiEZDSqD00kX+v/+W+OnxhNWoeVKorHygA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/mocker/node_modules/estree-walker": {
+       "version": "3.0.3",
+@@ -36834,7 +36868,9 @@
+       "license": "MIT",
+       "dependencies": {
+         "@types/estree": "^1.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
++      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/pretty-format": {
+       "version": "3.1.4",
+@@ -36845,7 +36881,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.1.4.tgz",
++      "integrity": "sha512-cqv9H9GvAEoTaoq+cYqUTCGscUjKqlJZC7PRwY5FMySVj5J+xOm1KQcCiYHJOEzOKRUhLH4R2pTwvFlWCEScsg=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/runner": {
+       "version": "3.1.4",
+@@ -36857,7 +36895,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-3.1.4.tgz",
++      "integrity": "sha512-djTeF1/vt985I/wpKVFBMWUlk/I7mb5hmD5oP8K9ACRmVXgKTae3TUOtXAEBfslNKPzUQvnKhNd34nnRSYgLNQ=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/snapshot": {
+       "version": "3.1.4",
+@@ -36870,7 +36910,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-3.1.4.tgz",
++      "integrity": "sha512-JPHf68DvuO7vilmvwdPr9TS0SuuIzHvxeaCkxYcCD4jTk67XwL45ZhEHFKIuCm8CYstgI6LZ4XbwD6ANrwMpFg=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/spy": {
+       "version": "3.1.4",
+@@ -36881,7 +36923,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.1.4.tgz",
++      "integrity": "sha512-Xg1bXhu+vtPXIodYN369M86K8shGLouNjoVI78g8iAq2rFoHFdajNvJJ5A/9bPMFcfQqdaCpOgWKEoMQg/s0Yg=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/spy/node_modules/tinyspy": {
+       "version": "3.0.2",
+@@ -36889,7 +36933,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">=14.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/tinyspy/-/tinyspy-3.0.2.tgz",
++      "integrity": "sha512-n1cw8k1k0x4pgA2+9XrOkFydTerNcJ1zWCO5Nn9scWHTD+5tp8dghT2x1uduQePZTZgd3Tupf+x9BxJjeJi77Q=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/utils": {
+       "version": "3.1.4",
+@@ -36902,12 +36948,16 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.1.4.tgz",
++      "integrity": "sha512-yriMuO1cfFhmiGc8ataN51+9ooHRuURdfAZfwFd3usWynjzpLslZdYnRegTv32qdgtJTsj15FoeZe2g15fY1gg=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/@vitest/utils/node_modules/loupe": {
+       "version": "3.1.3",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.1.3.tgz",
++      "integrity": "sha512-kkIp7XSkP78ZxJEsSxW3712C6teJVoeHHwgo9zJ380de7IYyJ2ISlxojcH2pC5OFLewESmnRi/+XCDIEEVyoug=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai": {
+       "version": "5.2.0",
+@@ -36922,7 +36972,9 @@
+       },
+       "engines": {
+         "node": ">=12"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/chai/-/chai-5.2.0.tgz",
++      "integrity": "sha512-mCuXncKXk5iCLhfhwTc0izo0gtEmpz5CtG2y8GiOINBlMVS6v8TMRc5TaLWKS6692m9+dVVfzgeVxR5UxWHTYw=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai/node_modules/assertion-error": {
+       "version": "2.0.1",
+@@ -36930,7 +36982,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">=12"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
++      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai/node_modules/check-error": {
+       "version": "2.1.1",
+@@ -36938,7 +36992,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">= 16"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.1.tgz",
++      "integrity": "sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai/node_modules/deep-eql": {
+       "version": "5.0.2",
+@@ -36946,12 +37002,16 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">=6"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz",
++      "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai/node_modules/loupe": {
+       "version": "3.1.3",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.1.3.tgz",
++      "integrity": "sha512-kkIp7XSkP78ZxJEsSxW3712C6teJVoeHHwgo9zJ380de7IYyJ2ISlxojcH2pC5OFLewESmnRi/+XCDIEEVyoug=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/chai/node_modules/pathval": {
+       "version": "2.0.0",
+@@ -36959,7 +37019,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">= 14.16"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.0.tgz",
++      "integrity": "sha512-vE7JKRyES09KiunauX7nd2Q9/L7lhok4smP9RZTDeD4MVs72Dp2qNFVz39Nz5a0FVEW0BJR6C0DYrq6unoziZA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/expect-type": {
+       "version": "1.2.1",
+@@ -36967,27 +37029,37 @@
+       "license": "Apache-2.0",
+       "engines": {
+         "node": ">=12.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.2.1.tgz",
++      "integrity": "sha512-/kP8CAwxzLVEeFrMm4kMmy4CCDlpipyA7MYLVrdJIkV0fYF0UaigQHRsxHiuY/GEea+bh4KSv3TIlgr+2UL6bw=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/pathe": {
+       "version": "2.0.3",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
++      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/std-env": {
+       "version": "3.9.0",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.9.0.tgz",
++      "integrity": "sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/tinybench": {
+       "version": "2.9.0",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
++      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/tinyexec": {
+       "version": "0.3.2",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
++      "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/tinypool": {
+       "version": "1.0.2",
+@@ -36995,7 +37067,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": "^18.0.0 || >=20.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.0.2.tgz",
++      "integrity": "sha512-al6n+QEANGFOMf/dmUMsuS5/r9B06uwlyNjZZql/zv8J7ybHCgoihBNORZCY2mzUuAnomQa2JdhyHKzZxPCrFA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/tinyrainbow": {
+       "version": "2.0.0",
+@@ -37003,7 +37077,9 @@
+       "license": "MIT",
+       "engines": {
+         "node": ">=14.0.0"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-2.0.0.tgz",
++      "integrity": "sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/vite-node": {
+       "version": "3.1.4",
+@@ -37024,7 +37100,9 @@
+       },
+       "funding": {
+         "url": "https://opencollective.com/vitest"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-3.1.4.tgz",
++      "integrity": "sha512-6enNwYnpyDo4hEgytbmc6mYWHXDHYEn0D1/rw4Q+tnHUGtKTJsn8T1YkX6Q18wI5LCrS8CTYlBaiCqxOy2kvUA=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/why-is-node-running": {
+       "version": "2.3.0",
+@@ -37039,17 +37117,23 @@
+       },
+       "engines": {
+         "node": ">=8"
+-      }
++      },
++      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
++      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/why-is-node-running/node_modules/siginfo": {
+       "version": "2.0.0",
+       "dev": true,
+-      "license": "ISC"
++      "license": "ISC",
++      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
++      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="
+     },
+     "packages/signing/node_modules/vitest/node_modules/why-is-node-running/node_modules/stackback": {
+       "version": "0.0.2",
+       "dev": true,
+-      "license": "MIT"
++      "license": "MIT",
++      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
++      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="
+     },
+     "packages/tailwind-config": {
+       "name": "@documenso/tailwind-config",
+@@ -37171,4 +37255,4 @@
+       "license": "MIT"
+     }
+   }
+-}
++}
+\ No newline at end of file

pkgs/by-name/do/documenso/package.json.patch

@@ -0,0 +1,40 @@
+diff --git a/package.json b/package.json
+index 1ff8701..e337979 100644
+--- a/package.json
++++ b/package.json
+@@ -44,22 +44,22 @@
+     "@commitlint/cli": "^17.7.1",
+     "@commitlint/config-conventional": "^17.7.0",
+     "@lingui/cli": "^5.2.0",
++    "@prisma/client": "^6.8.2",
+     "dotenv": "^16.5.0",
+     "dotenv-cli": "^8.0.0",
+     "eslint": "^8.40.0",
+     "eslint-config-custom": "*",
+     "husky": "^9.0.11",
+     "lint-staged": "^15.2.2",
++    "nodemailer": "^6.10.1",
+     "playwright": "1.52.0",
+     "prettier": "^3.3.3",
+-    "rimraf": "^5.0.1",
+-    "turbo": "^1.9.3",
+-    "vite": "^6.3.5",
+-    "@prisma/client": "^6.8.2",
+     "prisma": "^6.8.2",
+     "prisma-extension-kysely": "^3.0.0",
+     "prisma-kysely": "^1.8.0",
+-    "nodemailer": "^6.10.1"
++    "rimraf": "^5.0.1",
++    "turbo": "^2.5.8",
++    "vite": "^6.3.5"
+   },
+   "name": "@documenso/root",
+   "workspaces": [
+@@ -71,7 +71,6 @@
+     "@documenso/prisma": "^0.0.0",
+     "@lingui/conf": "^5.2.0",
+     "@lingui/core": "^5.2.0",
+-    "inngest-cli": "^0.29.1",
+     "luxon": "^3.5.0",
+     "mupdf": "^1.0.0",
+     "react": "^18",

pkgs/by-name/do/documenso/package.nix

@@ -1,50 +1,119 @@
 {
   lib,
+  nodejs,
+  node-gyp,
+  node-pre-gyp,
+  pixman,
   fetchFromGitHub,
   buildNpmPackage,
   prisma,
-  nix-update-script,
+  prisma-engines,
+  vips,
+  pkg-config,
+  cairo,
+  pango,
+  bash,
+  openssl,
 }:
 let
-  version = "0.9";
+  pname = "documenso";
+  version = "1.12.6";
 in
 buildNpmPackage {
-  pname = "documenso";
-  inherit version;
+
+  inherit version pname;
 
   src = fetchFromGitHub {
     owner = "documenso";
     repo = "documenso";
     rev = "v${version}";
-    hash = "sha256-uKOJVZ0GRHo/CYvd/Ix/tq1WDhutRji1tSGdcITsNlo=";
+    hash = "sha256-1TKjsOKJkv3COFgsE4tPAymI0MdeT+T8HiNgnoWHlAY=";
   };
 
-  nativeBuildInputs = [ prisma ];
+  npmDepsHash = "sha256-ZddRSBDasa3mMAS2dqXgXRMOc1nvspdXsuTZ7c+einw=";
 
-  preBuild = ''
-    # somehow for linux, npm is not finding the prisma package with the
-    # packages installed with the lockfile.
-    # This generates a prisma version incompatibility warning and is a kludge
-    # until the upstream package-lock is modified.
-    prisma generate
+  env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
+
+  env.PRISMA_QUERY_ENGINE_LIBRARY = "${prisma-engines}/lib/libquery_engine.node";
+  env.PRISMA_QUERY_ENGINE_BINARY = "${prisma-engines}/bin/query-engine";
+  env.PRISMA_SCHEMA_ENGINE_BINARY = "${prisma-engines}/bin/schema-engine";
+  env.TURBO_NO_UPDATE_NOTIFIER = "true";
+  env.TURBO_FORCE = "true";
+  env.TURBO_REMOTE_CACHE_ENABLED = "false";
+
+  nativeBuildInputs = [
+    pkg-config
+    vips
+    node-gyp
+  ];
+
+  buildInputs = [
+    node-pre-gyp
+    node-gyp
+    pixman
+    cairo
+    pango
+    vips
+  ];
+
+  patches = [
+    ./package-lock.json.patch
+    ./package.json.patch
+    ./turbo.json.patch
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    patchShebangs apps/remix/.bin/build.sh
+    npm exec turbo -- telemetry disable
+    npm exec turbo -- build --filter=@documenso/remix
+
+    runHook postBuild
   '';
 
-  npmDepsHash = "sha256-+JbvFMi8xoyxkuL9k96K1Vq0neciCGkkyZUPd15ES2E=";
-
   installPhase = ''
-    runHook preInstall
+          runHook preInstall
 
-    mkdir $out
-    cp -r node_modules $out/
-    cp package-lock.json $out
-    cp apps/web/package.json $out
-    cp -r apps/web/public $out/
-    cp -r apps/web/.next $out/
+          mkdir -p $out/bin
+          cp -r . $out/
 
-    runHook postInstall
+          cat > $out/bin/${pname} <<EOF
+    #!${bash}/bin/bash
+    export PKG_CONFIG_PATH=${openssl.dev}/lib/pkgconfig;
+    export PRISMA_QUERY_ENGINE_LIBRARY=${prisma-engines}/lib/libquery_engine.node
+    export PRISMA_QUERY_ENGINE_BINARY=${prisma-engines}/bin/query-engine
+    export PRISMA_SCHEMA_ENGINE_BINARY=${prisma-engines}
+    cd $out/apps/remix
+    ${prisma}/bin/prisma migrate deploy --schema ../../packages/prisma/schema.prisma
+    ${nodejs}/bin/node build/server/main.js
+    EOF
+          chmod +x $out/bin/${pname}
+
+          runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { };
+  # cleanup dangling symlinks for workspaces
+  preFixup = ''
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/assets
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/lib
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/documentation
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/prettier-config
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/signing
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/ui
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/eslint-config
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/tailwind-config
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/email
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/prisma
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/remix
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/openpage-api
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/api
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/tsconfig
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/app-tests
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/trpc
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/ee
+    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/auth
+  '';
 
   meta = with lib; {
     description = "Open Source DocuSign Alternative";
@@ -52,5 +121,6 @@ buildNpmPackage {
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ happysalada ];
     platforms = platforms.unix;
+    mainProgram = pname;
   };
 }

pkgs/by-name/do/documenso/turbo.json.patch

@@ -0,0 +1,104 @@
+diff --git a/turbo.json b/turbo.json
+index d767b46..b2d1ad3 100644
+--- a/turbo.json
++++ b/turbo.json
+@@ -1,41 +1,8 @@
+ {
+   "$schema": "https://turbo.build/schema.json",
+-  "pipeline": {
+-    "build": {
+-      "dependsOn": ["prebuild", "^build"],
+-      "outputs": [".next/**", "!.next/cache/**"]
+-    },
+-    "prebuild": {
+-      "cache": false,
+-      "dependsOn": ["^prebuild"]
+-    },
+-    "lint": {
+-      "cache": false
+-    },
+-    "lint:fix": {
+-      "cache": false
+-    },
+-    "clean": {
+-      "cache": false
+-    },
+-    "dev": {
+-      "cache": false,
+-      "persistent": true
+-    },
+-    "start": {
+-      "dependsOn": ["^build"],
+-      "cache": false,
+-      "persistent": true
+-    },
+-    "dev:test": {
+-      "cache": false
+-    },
+-    "test:e2e": {
+-      "dependsOn": ["^build"],
+-      "cache": false
+-    }
+-  },
+-  "globalDependencies": ["**/.env.*local"],
++  "globalDependencies": [
++    "**/.env.*local"
++  ],
+   "globalEnv": [
+     "APP_VERSION",
+     "NEXT_PRIVATE_ENCRYPTION_KEY",
+@@ -119,5 +86,53 @@
+     "E2E_TEST_AUTHENTICATE_USERNAME",
+     "E2E_TEST_AUTHENTICATE_USER_EMAIL",
+     "E2E_TEST_AUTHENTICATE_USER_PASSWORD"
+-  ]
++  ],
++  "tasks": {
++    "build": {
++      "dependsOn": [
++        "prebuild",
++        "^build"
++      ],
++      "outputs": [
++        ".next/**",
++        "!.next/cache/**"
++      ]
++    },
++    "prebuild": {
++      "cache": false,
++      "dependsOn": [
++        "^prebuild"
++      ]
++    },
++    "lint": {
++      "cache": false
++    },
++    "lint:fix": {
++      "cache": false
++    },
++    "clean": {
++      "cache": false
++    },
++    "dev": {
++      "cache": false,
++      "persistent": true
++    },
++    "start": {
++      "dependsOn": [
++        "^build"
++      ],
++      "cache": false,
++      "persistent": true
++    },
++    "dev:test": {
++      "cache": false
++    },
++    "test:e2e": {
++      "dependsOn": [
++        "^build"
++      ],
++      "cache": false
++    }
++  },
++  "envMode": "loose"
+ }

pkgs/by-name/do/documenso/update-from-upstream.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+CMDS=();DESC=();NARGS=$#;ARG1=$1;make_command(){ CMDS+=($1);DESC+=("$2");};usage(){ printf "\nUsage: %s [command]\n\nCommands:\n" $0;line="              ";for((i=0;i<=$(( ${#CMDS[*]} -1));i++));do printf "  %s %s ${DESC[$i]}\n" ${CMDS[$i]} "${line:${#CMDS[$i]}}";done;echo;};runme(){ if test $NARGS -eq 1;then eval "$ARG1"||usage;else usage;fi;}
+
+version="1.12.6";
+
+make_command "about" "About this update script."
+about(){
+  echo "Documenso upstream needs some fixing before it can be build in a pure sandbox"
+  echo "environment. This script does the following:"
+  echo "  - download documenso version ${version} from github in a temp dir"
+  echo "  - uninstall inngest-cli which runs a binary download script at build time."
+  echo "  - upgrade turborepo as the older upstream version 'phones home' at build time."
+  echo "  - update the turbo.json to make it work with preset environment vars"
+  echo "  - fix the lockfile by generating missing hash signatures"
+  echo "  - create patches from changed json files"
+}
+
+make_command "update" "Get upstream and prepatch."
+update(){
+
+  echo "updating documenso for nixpkgs packaging"
+  current_nixpkgs_dir=${PWD}
+  temptarfile=/tmp/documenso-v${version}.tar.gz
+  tempdir=/tmp/documenso-v${version}
+
+  if [ ! -f "$temptarfile" ]; then
+    echo "Tarball does not exist; downloading from github.";
+    wget https://github.com/documenso/documenso/archive/refs/tags/v${version}.tar.gz -O $temptarfile
+  fi
+
+  rm -Rf $tempdir
+  mkdir $tempdir
+  tar -xzvf /tmp/documenso-v${version}.tar.gz -C $tempdir --strip-components=1
+  cd $tempdir
+  git init
+  git add package-lock.json package.json turbo.json
+  git commit -m "commit4diff" package-lock.json package.json turbo.json
+
+  echo "rm inngest-cli from root"
+  npm uninstall inngest-cli
+
+  npx @turbo/codemod migrate . --force
+
+  jq '.envMode="loose"' turbo.json > turbo-patched.json
+  cp turbo-patched.json turbo.json
+
+  echo "fix package-lock.json hashes"
+  nix run nixpkgs#npm-lockfile-fix -- package-lock.json
+
+  git diff package-lock.json > $current_nixpkgs_dir/package-lock.json.patch
+  git diff package.json > $current_nixpkgs_dir/package.json.patch
+  git diff turbo.json > $current_nixpkgs_dir/turbo.json.patch
+}
+
+runme

pkgs/by-name/do/dovecot/package.nix

@@ -155,9 +155,9 @@ stdenv.mkDerivation rec {
     "--with-textcat"
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "i_cv_epoll_works=${if stdenv.hostPlatform.isLinux then "yes" else "no"}"
-    "i_cv_posix_fallocate_works=${if stdenv.hostPlatform.isDarwin then "no" else "yes"}"
-    "i_cv_inotify_works=${if stdenv.hostPlatform.isLinux then "yes" else "no"}"
+    "i_cv_epoll_works=${lib.boolToYesNo stdenv.hostPlatform.isLinux}"
+    "i_cv_posix_fallocate_works=${lib.boolToYesNo stdenv.hostPlatform.isDarwin}"
+    "i_cv_inotify_works=${lib.boolToYesNo stdenv.hostPlatform.isLinux}"
     "i_cv_signed_size_t=no"
     "i_cv_signed_time_t=yes"
     "i_cv_c99_vsnprintf=yes"

pkgs/by-name/dr/drat/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "drat";
+  version = "0.1.3-unstable-2024-01-07";
+
+  src = fetchFromGitHub {
+    owner = "jivanpal";
+    repo = "drat";
+    rev = "af573b9e067e8b6cbcc4825946e7e636b30c748f";
+    hash = "sha256-1NmqG73sP25Uqf7DiSPgt7drONOg9ZkrtCS0tYVjSU0=";
+  };
+
+  # Don't blow up on warnings; it makes upgrading the compiler difficult.
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail "-Werror" ""
+  '';
+
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install drat $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Utility for performing data recovery and analysis of APFS partitions/containers";
+    homepage = "https://github.com/jivanpal/drat";
+    changelog = "https://github.com/jivanpal/drat/blob/main/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ philiptaron ];
+    mainProgram = "drat";
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/er/ericw-tools/package.nix

@@ -61,6 +61,23 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace bspinfo/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace bsputil/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace light/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace qbsp/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace vis/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace man/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://ericwa.github.io/ericw-tools/";
     description = "Map compile tools for Quake and Hexen 2";

pkgs/by-name/ga/gate/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "gate";
-  version = "0.53.0";
+  version = "0.57.1";
 in
 buildGoModule {
   inherit pname version;
@@ -15,16 +15,21 @@ buildGoModule {
     owner = "minekube";
     repo = "gate";
     tag = "v${version}";
-    hash = "sha256-wrvq2opwT4bbplUljasWmT+JF3/lS8AyzBSfyUB3nUw=";
+    hash = "sha256-G4kmXGiogl/W6SYVWZyQsQE+6YO5Yggk8K4rH+t9znE=";
   };
 
-  vendorHash = "sha256-0NcfuCZHR4QHbMNqc+ilPouie+9k7FqOG/JdNX8uO8c=";
+  vendorHash = "sha256-2ZRfvjIGUznHjn7KA20uzEpVbI7EByNUYu6xALJEUfo=";
 
   ldflags = [
     "-s"
     "-w"
   ];
 
+  # this test requires network access, therefore it should not be run
+  preCheck = ''
+    rm ./pkg/edition/bedrock/geyser/managed/download_test.go
+  '';
+
   excludedPackages = [ ".web" ];
 
   meta = {

pkgs/by-name/gi/gitfetch/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  gh,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "gitfetch";
+  version = "1.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Matars";
+    repo = "gitfetch";
+    tag = "v${version}";
+    hash = "sha256-2cOfVv/snhluazyjwDuHEbbMq3cK+bsKYnnRmby0JDo=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    requests
+    readchar
+  ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        gh
+      ]
+    }"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Neofetch-style CLI tool for git provider statistics";
+    homepage = "https://github.com/Matars/gitfetch";
+    mainProgram = "gitfetch";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ lonerOrz ];
+  };
+}

pkgs/by-name/ha/hare/cross-compilation-tests.nix

@@ -2,7 +2,7 @@
   lib,
   file,
   hare,
-  runCommandNoCC,
+  runCommand,
   writeText,
 }:
 let
@@ -13,7 +13,7 @@ let
     export fn main() void = void;
   '';
 in
-runCommandNoCC "${hare.pname}-cross-compilation-test"
+runCommand "${hare.pname}-cross-compilation-test"
   {
     nativeBuildInputs = [
       hare

pkgs/by-name/ha/hare/mime-module-test.nix

@@ -1,6 +1,6 @@
 {
   hare,
-  runCommandNoCC,
+  runCommand,
   writeText,
 }:
 let
@@ -18,7 +18,7 @@ let
       };
   '';
 in
-runCommandNoCC "mime-module-test" { nativeBuildInputs = [ hare ]; } ''
+runCommand "mime-module-test" { nativeBuildInputs = [ hare ]; } ''
   HARECACHE="$(mktemp -d)"
   export HARECACHE
   readonly binout="test-bin"

pkgs/by-name/i2/i2pd/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   makeFlags = [
-    "USE_UPNP=${if upnpSupport then "yes" else "no"}"
+    "USE_UPNP=${lib.boolToYesNo upnpSupport}"
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/in/integrity-scrub/package.nix

@@ -34,5 +34,6 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.cc0;
     maintainers = with lib.maintainers; [ mvs ];
     platforms = lib.platforms.linux;
+    mainProgram = "integrity-scrub";
   };
 }

pkgs/by-name/ju/julec/hook.nix

@@ -1,6 +1,5 @@
 {
   julec,
-  clang,
   makeSetupHook,
 }:
 

pkgs/by-name/ju/julec/hook.sh

@@ -28,7 +28,7 @@ julecBuildHook() {
 
   julecSetEnv
   mkdir -p "$JULE_OUT_DIR"
-  julec --opt L2 -p -o "$JULE_OUT_DIR/$JULE_OUT_NAME" "$JULE_SRC_DIR"
+  julec build --opt L2 -p -o "$JULE_OUT_DIR/$JULE_OUT_NAME" "$JULE_SRC_DIR"
 
   runHook postBuild
 

pkgs/by-name/ju/julec/package.nix

@@ -22,23 +22,23 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "julec";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "julelang";
     repo = "jule";
     tag = "jule${finalAttrs.version}";
     name = "jule-${finalAttrs.version}";
-    hash = "sha256-y4v8FdQkB5Si3SYkchFG9fAU4ZhabAMcPkDcLEWW+6k=";
+    hash = "sha256-7py8QrNMX8LwpI7LCp5XgRFUzgltFP1rTbuzqw/1D8o=";
   };
 
   irSrc = fetchFromGitHub {
     owner = "julelang";
     repo = "julec-ir";
     # revision determined by the upstream commit hash in julec-ir/README.md
-    rev = "aebbd12c0f89f6a04f856f3e23d5ea39741c3e0f";
+    rev = "81ddbed06a715428a90d3645f7242fa4e522ea16";
     name = "jule-ir-${finalAttrs.version}";
-    hash = "sha256-7eDOYMmCEfW+0zZpESY1+ql3hWZZ/Q75lKT0nBQPktE=";
+    hash = "sha256-Az9RDrwRY2kuMgL/Lf/x6YctfySr96/imWZeOa+J/rM=";
   };
 
   dontConfigure = true;
@@ -76,7 +76,11 @@ clangStdenv.mkDerivation (finalAttrs: {
       -o "bin/${finalAttrs.meta.mainProgram}-bootstrap"
 
     echo "Building ${finalAttrs.meta.mainProgram} v${finalAttrs.version} for ${clangStdenv.hostPlatform.system}..."
-    bin/${finalAttrs.meta.mainProgram}-bootstrap --opt L2 -p -o "bin/${finalAttrs.meta.mainProgram}" "src/${finalAttrs.meta.mainProgram}"
+    bin/${finalAttrs.meta.mainProgram}-bootstrap build \
+      -p \
+      --opt L2 \
+      -o "bin/${finalAttrs.meta.mainProgram}" \
+      "src/${finalAttrs.meta.mainProgram}"
 
     runHook postBuild
   '';

pkgs/by-name/ju/julec/test/hello-jule/jule.mod

@@ -0,0 +1 @@
+module helloJule

pkgs/by-name/li/libcap/package.nix

@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "lib=lib"
-    "PAM_CAP=${if usePam then "yes" else "no"}"
+    "PAM_CAP=${lib.boolToYesNo usePam}"
     "BUILD_CC=$(CC_FOR_BUILD)"
     "CC:=$(CC)"
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"

pkgs/by-name/li/libdaemon/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Can't run this test while cross-compiling
-    "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
+    "ac_cv_func_setpgrp_void=${lib.boolToYesNo (!stdenv.hostPlatform.isBSD)}"
   ];
 
   meta = {

pkgs/by-name/li/libepoxy/package.nix

@@ -63,8 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   mesonFlags = [
-    "-Degl=${if (x11Support && !stdenv.hostPlatform.isDarwin) then "yes" else "no"}"
-    "-Dglx=${if x11Support then "yes" else "no"}"
+    "-Degl=${lib.boolToYesNo (x11Support && !stdenv.hostPlatform.isDarwin)}"
+    "-Dglx=${lib.boolToYesNo x11Support}"
     "-Dtests=${lib.boolToString finalAttrs.finalPackage.doCheck}"
     "-Dx11=${lib.boolToString x11Support}"
   ];

pkgs/by-name/li/libgpiod/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-tools=${if enable-tools then "yes" else "no"}"
+    "--enable-tools=${lib.boolToYesNo enable-tools}"
     "--enable-bindings-cxx"
   ];
 

pkgs/by-name/li/libgpiod_1/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--enable-tools=${if enable-tools then "yes" else "no"}"
+    "--enable-tools=${lib.boolToYesNo enable-tools}"
     "--enable-bindings-cxx"
     "--prefix=${placeholder "out"}"
   ]