Merge branch staging-next into haskell-updates

.github/workflows/eval.yml

@@ -81,6 +81,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ attrs, get-merge-commit ]
     strategy:
+      fail-fast: false
       matrix:
         system: ${{ fromJSON(needs.attrs.outputs.systems) }}
     steps:

maintainers/maintainer-list.nix

@@ -2222,6 +2222,12 @@
     githubId = 354741;
     name = "Austin Butler";
   };
+  automathis = {
+    name = "AutoMathïs";
+    email = "automathis@protonmail.com";
+    github = "MathisFederico";
+    githubId = 60117466;
+  };
   autophagy = {
     email = "mail@autophagy.io";
     github = "autophagy";
@@ -12001,6 +12007,12 @@
     githubId = 12898828;
     keys = [ { fingerprint = "B44A DFDF F869 A66A 3FDF  DD8B 8609 A7B5 19E5 E342"; } ];
   };
+  kmatasfp = {
+    email = "el-development@protonmail.com";
+    name = "Kaur Matas";
+    github = "kmatasfp";
+    githubId = 33095685;
+  };
   kmcopper = {
     email = "kmcopper@danwin1210.me";
     name = "Kyle Copperfield";
@@ -12346,6 +12358,12 @@
     githubId = 11614750;
     name = "Alexander Sharov";
   };
+  kvik = {
+    email = "viktor@a-b.xyz";
+    github = "okvik";
+    githubId = 58425080;
+    name = "Viktor Pocedulić";
+  };
   kwaa = {
     name = "藍+85CD";
     email = "kwa@kwaa.dev";
@@ -13585,6 +13603,13 @@
     githubId = 1809783;
     name = "Marco Maggesi";
   };
+  magneticflux- = {
+    email = "skaggsm333@gmail.com";
+    github = "magneticflux-";
+    githubId = 9124288;
+    name = "Mitchell Skaggs";
+    keys = [ { fingerprint = "CA2A 3324 43A7 BD99 8FCE  DFC4 4EB0 FECB 84AE 8967"; } ];
+  };
   magnetophon = {
     email = "bart@magnetophon.nl";
     github = "magnetophon";
@@ -15806,6 +15831,12 @@
     githubId = 3747396;
     name = "Nathan Isom";
   };
+  negatethis = {
+    email = "negatethis@envs.net";
+    github = "negatethis";
+    githubId = 26014535;
+    name = "Negate This";
+  };
   neilmayhew = {
     email = "nix@neil.mayhew.name";
     github = "neilmayhew";
@@ -23433,6 +23464,12 @@
     githubId = 17836748;
     name = "Mason Mackaman";
   };
+  usertam = {
+    email = "nix@usertam.dev";
+    github = "usertam";
+    githubId = 22500027;
+    name = "Samuel Tam";
+  };
   uskudnik = {
     email = "urban.skudnik@gmail.com";
     github = "uskudnik";

maintainers/team-list.nix

@@ -478,7 +478,6 @@ with lib.maintainers;
     members = [
       cdepillabout
       maralorn
-      ncfavier
       sternenseemann
     ];
     githubTeams = [ "haskell" ];

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -165,6 +165,12 @@
   ```
   This changed follows a deprecation period of one year started in NixOS 24.05 (see [PR #283818](https://github.com/NixOS/nixpkgs/pull/283818)).
 
+- The values of `services.borgbackup.jobs.*.extraArgs` and other `extra*Args` options are now represented as Bash arrays. If these arguments were modified using `services.borgbackup.jobs.*.preHook`, they will need to be adjusted to append to these arrays, i.e.
+  ```diff
+  -extraCreateArgs="$extraCreateArgs --exclude /some/path"
+  +extraCreateArgs+=("--exclude" "/some/path")
+  ```
+
 - `nodePackages.ganache` has been removed, as the package has been deprecated by upstream.
 
 - `virtualisation.azure.agent` option provided by `azure-agent.nix` is replaced by `services.waagent`, and will be removed in a future release.
@@ -223,6 +229,8 @@
 - `zf` was updated to 0.10.2, which includes breaking changes from the [0.10.0 release](https://github.com/natecraddock/zf/releases/tag/0.10.0).
   `zf` no longer does Unicode normalization of the input and no longer supports terminal escape sequences in the `ZF_PROMPT` environment variable.
 
+- `programs.clash-verge.tunMode` was deprecated and removed because now service mode is neccessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-25.05-notable-changes}

nixos/modules/programs/clash-verge.nix

@@ -6,6 +6,11 @@
 }:
 
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "programs" "clash-verge" "tunMode" ] ''
+      The tunMode will work with service mode which is enabled by default.
+    '')
+  ];
   options.programs.clash-verge = {
     enable = lib.mkEnableOption "Clash Verge";
     package = lib.mkOption {
@@ -15,10 +20,10 @@
         clash-verge-rev and clash-nyanpasu, both are forks of
         the original clash-verge project.
       '';
-      example = "pkgs.clash-verge-rev";
+      default = pkgs.clash-verge-rev;
+      defaultText = lib.literalExpression "pkgs.clash-verge-rev";
     };
     autoStart = lib.mkEnableOption "Clash Verge auto launch";
-    tunMode = lib.mkEnableOption "Clash Verge TUN mode";
   };
 
   config =
@@ -37,13 +42,19 @@
         ))
       ];
 
-      security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
-        owner = "root";
-        group = "root";
-        capabilities = "cap_net_bind_service,cap_net_admin=+ep";
-        source = "${lib.getExe cfg.package}";
+      systemd.services.clash-verge = {
+        enable = true;
+        description = "Clash Verge Service Mode";
+        serviceConfig = {
+          ExecStart = "${cfg.package}/bin/clash-verge-service";
+          Restart = "on-failure";
+        };
+        wantedBy = [ "multi-user.target" ];
       };
     };
 
-  meta.maintainers = with lib.maintainers; [ zendo ];
+  meta.maintainers = with lib.maintainers; [
+    bot-wxt1221
+    Guanran928
+  ];
 }

nixos/modules/services/backup/borgbackup.nix

@@ -20,8 +20,19 @@ let
     lib.concatStringsSep " "
       (lib.mapAttrsToList (x: y: "--keep-${x}=${toString y}") cfg.prune.keep);
 
+  mkExtraArgs = cfg:
+    # Create BASH arrays of extra args
+    lib.concatLines
+      (lib.mapAttrsToList (name: values: ''
+        ${name}=(${values})
+      '')
+  { inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs extraCompactArgs; });
+
   mkBackupScript = name: cfg: pkgs.writeShellScript "${name}-script" (''
     set -e
+
+    ${mkExtraArgs cfg}
+
     on_exit()
     {
       exitStatus=$?
@@ -46,35 +57,35 @@ let
     ${cfg.preHook}
   '' + lib.optionalString cfg.doInit ''
     # Run borg init if the repo doesn't exist yet
-    if ! borgWrapper list $extraArgs > /dev/null; then
-      borgWrapper init $extraArgs \
+    if ! borgWrapper list "''${extraArgs[@]}" > /dev/null; then
+      borgWrapper init "''${extraArgs[@]}" \
         --encryption ${cfg.encryption.mode} \
-        $extraInitArgs
+        "''${extraInitArgs[@]}"
       ${cfg.postInit}
     fi
   '' + ''
     (
       set -o pipefail
       ${lib.optionalString (cfg.dumpCommand != null) ''${lib.escapeShellArg cfg.dumpCommand} | \''}
-      borgWrapper create $extraArgs \
+      borgWrapper create "''${extraArgs[@]}" \
         --compression ${cfg.compression} \
         --exclude-from ${mkExcludeFile cfg} \
         --patterns-from ${mkPatternsFile cfg} \
-        $extraCreateArgs \
+        "''${extraCreateArgs[@]}" \
         "::$archiveName$archiveSuffix" \
         ${if cfg.paths == null then "-" else lib.escapeShellArgs cfg.paths}
     )
   '' + lib.optionalString cfg.appendFailedSuffix ''
-    borgWrapper rename $extraArgs \
+    borgWrapper rename "''${extraArgs[@]}" \
       "::$archiveName$archiveSuffix" "$archiveName"
   '' + ''
     ${cfg.postCreate}
   '' + lib.optionalString (cfg.prune.keep != { }) ''
-    borgWrapper prune $extraArgs \
+    borgWrapper prune "''${extraArgs[@]}" \
       ${mkKeepArgs cfg} \
       ${lib.optionalString (cfg.prune.prefix != null) "--glob-archives ${lib.escapeShellArg "${cfg.prune.prefix}*"}"} \
-      $extraPruneArgs
-    borgWrapper compact $extraArgs $extraCompactArgs
+      "''${extraPruneArgs[@]}"
+    borgWrapper compact "''${extraArgs[@]}" "''${extraCompactArgs[@]}"
     ${cfg.postPrune}
   '');
 
@@ -120,7 +131,6 @@ let
       };
       environment = {
         BORG_REPO = cfg.repo;
-        inherit (cfg) extraArgs extraInitArgs extraCreateArgs extraPruneArgs extraCompactArgs;
       } // (mkPassEnv cfg) // cfg.environment;
     };
 
@@ -236,7 +246,7 @@ let
   };
 
 in {
-  meta.maintainers = with lib.maintainers; [ dotlambda ];
+  meta.maintainers = with lib.maintainers; [ dotlambda Scrumplex ];
   meta.doc = ./borgbackup.md;
 
   ###### interface
@@ -581,7 +591,7 @@ in {
             default = "";
             example = ''
               # To add excluded paths at runtime
-              extraCreateArgs="$extraCreateArgs --exclude /some/path"
+              extraCreateArgs+=("--exclude" "/some/path")
             '';
           };
 

nixos/modules/services/misc/gitlab.nix

@@ -1242,6 +1242,7 @@ in {
       enable = true;
       enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
       package = cfg.registry.package;
+      port = cfg.registry.port;
       extraConfig = {
         auth.token = {
           realm = "http${optionalString (cfg.https == true) "s"}://${cfg.host}/jwt/auth";

nixos/modules/services/misc/jackett.nix

@@ -60,6 +60,55 @@ in
         Group = cfg.group;
         ExecStart = "${cfg.package}/bin/Jackett --NoUpdates --Port ${toString cfg.port} --DataFolder '${cfg.dataDir}'";
         Restart = "on-failure";
+
+        # Sandboxing
+        CapabilityBoundingSet = [
+          "CAP_NET_BIND_SERVICE"
+        ];
+        ExecPaths = [
+          "${builtins.storeDir}"
+        ];
+        LockPersonality = true;
+        NoExecPaths = [
+          "/"
+        ];
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = [
+          "${config.users.users.${cfg.user}.home}"
+        ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@clock"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@obsolete"
+          "~@reboot"
+          "~@module"
+          "~@mount"
+          "~@swap"
+        ];
+        UMask = "0077";
       };
     };
 

nixos/modules/services/networking/bind.nix

@@ -246,29 +246,68 @@ in
       };
     users.groups.${bindUser} = {};
 
+    systemd.tmpfiles.settings."bind" = lib.mkIf (cfg.directory != "/run/named") {
+      ${cfg.directory} = {
+        d = {
+          user = bindUser;
+          group = bindUser;
+          age = "-";
+        };
+      };
+    };
     systemd.services.bind = {
       description = "BIND Domain Name Server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        mkdir -m 0755 -p /etc/bind
         if ! [ -f "/etc/bind/rndc.key" ]; then
-          ${bindPkg.out}/sbin/rndc-confgen -c /etc/bind/rndc.key -u ${bindUser} -a -A hmac-sha256 2>/dev/null
+          ${bindPkg.out}/sbin/rndc-confgen -c /etc/bind/rndc.key -a -A hmac-sha256 2>/dev/null
         fi
-
-        ${pkgs.coreutils}/bin/mkdir -p /run/named
-        chown ${bindUser} /run/named
-
-        ${pkgs.coreutils}/bin/mkdir -p ${cfg.directory}
-        chown ${bindUser} ${cfg.directory}
       '';
 
       serviceConfig = {
         Type = "forking"; # Set type to forking, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900788
-        ExecStart = "${bindPkg.out}/sbin/named -u ${bindUser} ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile}";
+        ExecStart = "${bindPkg.out}/sbin/named ${lib.optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile}";
         ExecReload = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' reload";
         ExecStop = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
+        User = bindUser;
+        RuntimeDirectory = "named";
+        RuntimeDirectoryPreserve = "yes";
+        ConfigurationDirectory = "bind";
+        ReadWritePaths = [
+          (lib.mapAttrsToList (name: config: if (lib.hasPrefix "/" config.file) then ("-${dirOf config.file}") else "") cfg.zones)
+          cfg.directory
+        ];
+        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        ProtectSystem = "strict";
+        ReadOnlyPaths = "/sys";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6 AF_NETLINK" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictNamespaces = true;
+        # System Call Filtering
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "~@mount @debug @clock @reboot @resources @privileged @obsolete acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie migrate_pages move_pages open_by_handle_at perf_event_open process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon uselib vmsplice";
       };
 
       unitConfig.Documentation = "man:named(8)";

nixos/modules/services/networking/mullvad-vpn.nix

@@ -10,7 +10,6 @@ with lib;
       default = false;
       description = ''
         This option enables Mullvad VPN daemon.
-        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
       '';
     };
 
@@ -36,12 +35,6 @@ with lib;
 
     environment.systemPackages = [ cfg.package ];
 
-    # mullvad-daemon writes to /etc/iproute2/rt_tables
-    networking.iproute2.enable = true;
-
-    # See https://github.com/NixOS/nixpkgs/issues/113589
-    networking.firewall.checkReversePath = "loose";
-
     # See https://github.com/NixOS/nixpkgs/issues/176603
     security.wrappers.mullvad-exclude = mkIf cfg.enableExcludeWrapper {
       setuid = true;
@@ -59,13 +52,9 @@ with lib;
         "NetworkManager.service"
         "systemd-resolved.service"
       ];
-      path = [
-        pkgs.iproute2
-        # Needed for ping
-        "/run/wrappers"
-        # See https://github.com/NixOS/nixpkgs/issues/262681
-      ] ++ (lib.optional config.networking.resolvconf.enable
-        config.networking.resolvconf.package);
+      # See https://github.com/NixOS/nixpkgs/issues/262681
+      path = lib.optional config.networking.resolvconf.enable
+        config.networking.resolvconf.package;
       startLimitBurst = 5;
       startLimitIntervalSec = 20;
       serviceConfig = {

nixos/tests/borgbackup.nix

@@ -3,6 +3,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let
   passphrase = "supersecret";
   dataDir = "/ran:dom/data";
+  subDir = "not_anything_here";
+  excludedSubDirFile = "not_this_file_either";
   excludeFile = "not_this_file";
   keepFile = "important_file";
   keepFileData = "important_data";
@@ -69,6 +71,7 @@ in {
             yearly = 5;
           };
           exclude = [ "*/${excludeFile}" ];
+          extraCreateArgs = [ "--exclude-caches" "--exclude-if-present" ".dont backup" ];
           postHook = "echo post";
           startAt = [ ]; # Do not run automatically
         };
@@ -166,8 +169,10 @@ in {
     )
     client.succeed("chmod 0600 /root/id_ed25519.appendOnly")
 
-    client.succeed("mkdir -p ${dataDir}")
+    client.succeed("mkdir -p ${dataDir}/${subDir}")
     client.succeed("touch ${dataDir}/${excludeFile}")
+    client.succeed("touch '${dataDir}/${subDir}/.dont backup'")
+    client.succeed("touch ${dataDir}/${subDir}/${excludedSubDirFile}")
     client.succeed("echo '${keepFileData}' > ${dataDir}/${keepFile}")
 
     with subtest("local"):
@@ -180,6 +185,10 @@ in {
         client.fail(
             "{} list '${localRepo}::${archiveName}' | grep -qF '${excludeFile}'".format(borg)
         )
+        # Make sure excludedSubDirFile has been excluded
+        client.fail(
+            "{} list '${localRepo}::${archiveName}' | grep -qF '${subDir}/${excludedSubDirFile}".format(borg)
+        )
         # Make sure keepFile has the correct content
         client.succeed("{} extract '${localRepo}::${archiveName}'".format(borg))
         assert "${keepFileData}" in client.succeed("cat ${dataDir}/${keepFile}")

pkgs/applications/audio/jamulus/default.nix

@@ -1,43 +0,0 @@
-{ mkDerivation
-, lib
-, fetchFromGitHub
-, pkg-config
-, qtscript
-, qmake
-, qtbase
-, qtmultimedia
-, qtdeclarative
-, libjack2
-}:
-
-mkDerivation rec {
-  pname = "jamulus";
-  version = "3.10.0";
-  src = fetchFromGitHub {
-    owner = "jamulussoftware";
-    repo = "jamulus";
-    rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-uqBre1Hcdmmifm/gii3MlP9LiAovQVsAaPZTmVm1nnM=";
-  };
-
-  nativeBuildInputs = [ pkg-config qmake ];
-  buildInputs = [
-    qtscript
-    qtbase
-    qtmultimedia
-    qtdeclarative
-    libjack2
-  ];
-
-  qmakeFlags = [ "CONFIG+=noupcasename" ];
-
-  meta = {
-    description = "Enables musicians to perform real-time jam sessions over the internet";
-    longDescription = "You also need to enable JACK and should enable several real-time optimizations. See project website for details";
-    homepage = "https://github.com/corrados/jamulus/wiki";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-    mainProgram = "jamulus";
-    maintainers = [ lib.maintainers.seb314 ];
-  };
-}

pkgs/applications/audio/littlegptracker/0001-Remove-coherency-checks.patch

@@ -1,52 +0,0 @@
-From 2e1e9b3ffce9d1069fca0b27b8011f85c7547c3b Mon Sep 17 00:00:00 2001
-From: Francesco Gazzetta <fgaz@fgaz.me>
-Date: Wed, 19 Aug 2020 15:06:19 +0200
-Subject: [PATCH 1/2] Remove coherency checks >:)
-
-As far as I can see, they are just to make sure that the types can fit
-in the word length, but this check was written when 64 bits weren't a
-possibility and didn't take that into account,
-so although the types do fit, the checks fail.
-Indeed, the program seems to work well on 64 bits.
-More info here:
-https://github.com/Mdashdotdashn/LittleGPTracker/issues/4
----
- sources/Externals/Soundfont/DATATYPE.H | 22 ----------------------
- 1 file changed, 22 deletions(-)
-
-diff --git a/sources/Externals/Soundfont/DATATYPE.H b/sources/Externals/Soundfont/DATATYPE.H
-index 762a724..f6b031f 100644
---- a/sources/Externals/Soundfont/DATATYPE.H
-+++ b/sources/Externals/Soundfont/DATATYPE.H
-@@ -123,28 +123,6 @@ typedef short               SHORT;     /* 16 bit signed value was: INT */
- ********************************************************************/
- typedef unsigned short        EMUSTAT;
- 
--/********************************************************************
--* Compare <limits.h> values with SoundFont Enabler limits.  Fail compile
--* if discrepency. If compile fails due to one of these errors, then
--* the SoundFont enabler will not work with your system or the state of your
--* development environment.
--********************************************************************/
--#if (SCHAR_MAX != CHAR_MAXVAL) || (UCHAR_MAX != BYTE_MAXVAL)
--  #error <datatype.h>: char is out of range!
--#endif
--
--#if (SHRT_MAX != SHRT_MAXVAL)
--  #error <datatype.h>: short is out of range!
--#endif
--
--#if (LONG_MAX != LONG_MAXVAL)
--  #error <datatype.h>: long is out of range!
--#endif
--
--#if (ULONG_MAX != DWORD_MAXVAL)
--  #error <datatype.h>: unsigned long is out of range!
--#endif
--
- #ifdef __BYTE_COHERENT
- 
- /********************************************************************
--- 
-2.25.4
-

pkgs/applications/audio/littlegptracker/default.nix

@@ -1,75 +1,78 @@
-{ lib, stdenv
-, fetchFromGitHub
-, unstableGitUpdater
-, SDL
-, jack2
-, Foundation
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  SDL2,
+  python3,
+  jack2,
+  Foundation,
+  alsa-lib,
+  pkg-config,
 }:
-
-stdenv.mkDerivation {
+let
+  python = python3.withPackages (ps: with ps; [ pillow ]);
+  platform = if stdenv.hostPlatform.isDarwin then "OSX" else "X64";
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "littlegptracker";
-  version = "0-unstable-2020-11-26";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
-    owner = "Mdashdotdashn";
+    owner = "djdiskmachine";
     repo = "littlegptracker";
-    rev = "4aca8cd765e1ad586da62decd019e66cb64b45b8";
-    sha256 = "0f2ip8z5wxk8fvlw47mczsbcrzh4nh1hgw1fwf5gjrqnzm8v111x";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-1uXC5nJ63YguQuNIkuK0yx9lmrMBqw0WdlmCV8o11cE=";
   };
 
-  buildInputs = [
-    SDL
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin Foundation
-  ++ lib.optional stdenv.hostPlatform.isLinux jack2;
+  nativeBuildInputs = [
+    pkg-config
+    python
+  ];
+  buildInputs =
+    [ SDL2 ]
+    ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform alsa-lib) alsa-lib
+    ++ lib.optional stdenv.hostPlatform.isDarwin Foundation
+    ++ lib.optional stdenv.hostPlatform.isLinux jack2;
 
-  patches = [
-    # Remove outdated (pre-64bit) checks that would fail on modern platforms
-    # (see description in patch file)
-    ./0001-Remove-coherency-checks.patch
+  preBuild = ''
+    cd projects
+  '';
+
+  makeFlags = [
+    "CXX=${stdenv.cc.targetPrefix}c++"
+    "PLATFORM=${platform}"
   ];
 
-  preBuild = "cd projects";
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework Foundation";
 
-  makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux  [ "PLATFORM=DEB" ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ "PLATFORM=OSX" ];
-
-  env.NIX_CFLAGS_COMPILE = toString ([ "-fpermissive" ] ++
-    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing");
-
-  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isDarwin "-framework Foundation";
-
-  installPhase = let extension = if stdenv.hostPlatform.isDarwin then "app" else "deb-exe";
-    in "install -Dm555 lgpt.${extension} $out/bin/lgpt";
-
-  passthru.updateScript = unstableGitUpdater {
-    url = "https://github.com/Mdashdotdashn/littlegptracker.git";
-  };
-
-  meta = with lib; {
-    description = "Music tracker similar to lsdj optimised to run on portable game consoles";
-    longDescription = ''
-      LittleGPTracker (a.k.a 'The piggy', 'lgpt') is a music tracker optimised
-      to run on portable game consoles. It is currently running on Game Park's
-      GP2x & Caanoo, PSP, Dingoo, Windows, Mac OSX (intel/ppc) & Linux (Debian).
-
-      It implements the user interface of littlesounddj, a very famous tracker
-      for the Gameboy platform that has been tried and tested by many users over
-      the years, leading to a little complex but yet extremely efficent way of
-      working.
-
-      Piggy currently supports 8 monophonic 16Bit/44.1Khz stereo sample playback
-      channels. Additionally, the program can drive MIDI instruments (with the
-      gp32 and gp2x a custom MIDI interface is required).
+  installPhase =
+    let
+      extension = if stdenv.hostPlatform.isDarwin then "app" else "x64";
+    in
+    ''
+      runHook preInstall
+      install -Dm555 lgpt.${extension} $out/lib/lgpt/lgpt
+      install -Dm444 resources/${platform}/{config,mapping}.xml $out/lib/lgpt/
+      mkdir -p $out/bin
+      ln -s $out/lib/lgpt/lgpt $out/bin/
+      runHook postInstall
     '';
-    homepage = "https://www.littlegptracker.com/";
-    downloadPage = "https://www.littlegptracker.com/download.php";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
-    # https://github.com/NixOS/nixpkgs/pull/91766#issuecomment-688751821
-    broken = stdenv.hostPlatform.isDarwin;
+
+  meta = {
+    description = "Music tracker optimised to run on portable game consoles";
+    longDescription = ''
+      Little Piggy Tracker (f.k.a 'LittleGPTracker') is a music tracker optimised to run on portable game consoles.
+      It is currently running on Windows, MacOS (intel/arm) & Linux, PSP, Miyoo Mini, and a collection of other retro gaming handhelds.
+      It implements the user interface of littlesounddj and precedes M8 tracker, two popular trackers greatly loved in the tracker community.
+    '';
+    homepage = "https://github.com/djdiskmachine/LittleGPTracker";
+    downloadPage = "https://github.com/djdiskmachine/LittleGPTracker/releases";
     mainProgram = "lgpt";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
+
+    # https://github.com/NixOS/nixpkgs/pull/352617#issuecomment-2495663097
+    broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})

pkgs/applications/editors/sublime/4/packages.nix

@@ -5,15 +5,15 @@ let
 in
 {
   sublime4 = common {
-    buildVersion = "4186";
-    x64sha256 = "Rw/N2uSsMb6uMvMt9lEzBFSAvAePFTwfX09ARDX1mSs=";
-    aarch64sha256 = "6RKaSIDj0zOqjYAGb77q3+sKqmp+VFqcgODyU06ajrc=";
+    buildVersion = "4189";
+    x64sha256 = "0vEG2FfLK+93UtpYV9iWl187iN79Tozm38Vh6lbzW7A=";
+    aarch64sha256 = "ZyLnbvpyxvJfyfu663ED0Yn5M37As+jy6TREZMgSHgI=";
   } { };
 
   sublime4-dev = common {
-    buildVersion = "4187";
+    buildVersion = "4188";
     dev = true;
-    x64sha256 = "4Xcpnvplj3ik3kWtwJ6ZT//nRgMCw/ceN7bVuEDApDA=";
-    aarch64sha256 = "EreN+SjVnm1Kt+Oz72AQ86AKdgm9n72lv/JQvefb8YU=";
+    x64sha256 = "b7JyJ9cPxb/Yjy9fvcz/m6OLETxMd8rwkmrEyMGAjjc=";
+    aarch64sha256 = "oGL0UtQge21oH6p6BNsRkxqgvdi9PkT/uwZTYygu+ng=";
   } { };
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -552,13 +552,13 @@
     "vendorHash": null
   },
   "harbor": {
-    "hash": "sha256-JdCBeUYB6rkSNhfTTIoRV8Bz4FnlHJFJxEZZbqyzAyc=",
+    "hash": "sha256-NDOFrW7VeunxAJPkcJ4DFrjrt0fL5B5+gT9H19L1Cos=",
     "homepage": "https://registry.terraform.io/providers/goharbor/harbor",
     "owner": "goharbor",
     "repo": "terraform-provider-harbor",
-    "rev": "v3.10.15",
+    "rev": "v3.10.17",
     "spdx": "MIT",
-    "vendorHash": "sha256-TZxiDRVZPfg3jSflZsSbVaVcfUNqJ2U+ymHIm01pgkI="
+    "vendorHash": "sha256-YkTXwx3RjIbzJnagfcYgb5IRnF0sHEDBDzdHf+GS8xI="
   },
   "hcloud": {
     "hash": "sha256-nkp4XTFRBSxqRAURL0O4H/l7oDF/OEXmew0MkmyQryc=",

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -1,85 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchYarnDeps
-, jq
-, yarn
-, fixup-yarn-lock
-, nodejs
-, jitsi-meet
-}:
-
-let
-  pinData = import ./pin.nix;
-  inherit (pinData.hashes) webSrcHash webYarnHash;
-  noPhoningHome = {
-    disable_guests = true; # disable automatic guest account registration at matrix.org
-  };
-in
-stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
-  pname = "element-web";
-
-  src = fetchFromGitHub {
-    owner = "element-hq";
-    repo = "element-web";
-    rev = "v${finalAttrs.version}";
-    hash = webSrcHash;
-  };
-
-  offlineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    sha256 = webYarnHash;
-  };
-
-  nativeBuildInputs = [ yarn fixup-yarn-lock jq nodejs ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    export VERSION=${finalAttrs.version}
-    yarn --offline build:res
-    yarn --offline build:module_system
-    yarn --offline build:bundle
-
-    runHook postBuild
-  '';
-
-  configurePhase = ''
-    runHook preConfigure
-
-    export HOME=$PWD/tmp
-    # with the update of openssl3, some key ciphers are not supported anymore
-    # this flag will allow those codecs again as a workaround
-    # see https://medium.com/the-node-js-collection/node-js-17-is-here-8dba1e14e382#5f07
-    # and https://github.com/element-hq/element-web/issues/21043
-    export NODE_OPTIONS=--openssl-legacy-provider
-    mkdir -p $HOME
-
-    fixup-yarn-lock yarn.lock
-    yarn config --offline set yarn-offline-mirror $offlineCache
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-    patchShebangs node_modules
-
-    runHook postConfigure
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -R webapp $out
-    tar --extract --to-stdout --file ${jitsi-meet.src} jitsi-meet/libs/external_api.min.js > $out/jitsi_external_api.min.js
-    echo "${finalAttrs.version}" > "$out/version"
-    jq -s '.[0] * $conf' "config.sample.json" --argjson "conf" '${builtins.toJSON noPhoningHome}' > "$out/config.json"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Glossy Matrix collaboration client for the web";
-    homepage = "https://element.io/";
-    changelog = "https://github.com/element-hq/element-web/blob/v${finalAttrs.version}/CHANGELOG.md";
-    maintainers = lib.teams.matrix.members;
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.all;
-  };
-})

pkgs/applications/networking/instant-messengers/element/pin.nix

@@ -1,9 +0,0 @@
-{
-  "version" = "1.11.87";
-  "hashes" = {
-    "desktopSrcHash" = "sha256-rIxuXMHQVJrbfWibpiIBmTkXKHrBqnTMiBYIP8VOIH4=";
-    "desktopYarnHash" = "05qs1an3mbqsfn1nmgwagp564lqvyrbkyj58z5h2cbczqbavnxxz";
-    "webSrcHash" = "sha256-FcXYwYCx//fqWuUKRqTTntlT7jVBD1Heayg4T7ACHmc=";
-    "webYarnHash" = "0anamnfm5g4nj7wp18byi49x38aia490qfard2d34myzjgiby8v3";
-  };
-}

pkgs/applications/networking/rymdport/default.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "rymdport";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "Jacalz";
     repo = "rymdport";
     rev = "v${version}";
-    hash = "sha256-PMCetU+E0Kl50K7sJB6UiHVouWPtfW8ALXFacxCvAhE=";
+    hash = "sha256-o+FmAG+Zcuud2CKtMLQkdLkXyJ41kaXn3qp/O6rUXJA=";
   };
 
-  vendorHash = "sha256-RsmwTRVjhEgKAT9aekSfkRuai2165KG7q5aFjAiLSPU=";
+  vendorHash = "sha256-daOYPZri/ikshTUh3Lk2qHTbeD9mNUUue35aG/b4c88=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/office/qownnotes/default.nix

@@ -20,14 +20,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.12.1";
+  version = "24.12.4";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-OiaZmd50kOTJSJesBYFdjjKzNUc/m7XrU5S27z0mtAI=";
+    hash = "sha256-1DHBi++7GlSxnA8fAWC4rHej9wi8jDvI2pQduqZhNZQ=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/softmaker/generic.nix

@@ -46,7 +46,7 @@ in
 stdenv.mkDerivation {
   inherit pname src;
 
-  version = "${edition}.${version}";
+  version = if edition != "" then "${edition}.${version}" else version;
 
   nativeBuildInputs = [
     autoPatchelfHook

pkgs/applications/office/softmaker/softmaker-office-nx.nix

@@ -0,0 +1,32 @@
+{
+  callPackage,
+  fetchurl,
+
+  # This is a bit unusual, but makes version and hash easily
+  # overridable. This is useful when the upstream archive was replaced
+  # and nixpkgs is not in sync yet.
+  officeVersion ? {
+    version = "1222";
+    edition = "";
+    hash = "sha256-8ya9RYpd9G5SITYOpvhxjQE8ieV8TuAApkjNwCf9nHs=";
+  },
+
+  ...
+}@args:
+
+callPackage ./generic.nix (
+  args
+  // rec {
+    inherit (officeVersion) version edition;
+
+    pname = "softmaker-office-nx";
+    suiteName = "SoftMaker Office NX";
+
+    src = fetchurl {
+      inherit (officeVersion) hash;
+      url = "https://www.softmaker.net/down/softmaker-office-nx-${version}-amd64.tgz";
+    };
+
+    archive = "officenx.tar.lzma";
+  }
+)

pkgs/applications/radio/welle-io/default.nix

@@ -17,6 +17,8 @@
   fftwSinglePrec,
   lame,
   mpg123,
+  withFlac ? true,
+  flac,
 }:
 
 stdenv.mkDerivation rec {
@@ -48,12 +50,12 @@ stdenv.mkDerivation rec {
     qt5compat
     rtl-sdr
     soapysdr-with-plugins
-  ];
+  ] ++ lib.optional withFlac flac;
 
   cmakeFlags = [
     "-DRTLSDR=true"
     "-DSOAPYSDR=true"
-  ];
+  ] ++ lib.optional withFlac "-DFLAC=true";
 
   meta = {
     description = "DAB/DAB+ Software Radio";

pkgs/applications/video/kodi/unwrapped.nix

@@ -126,7 +126,7 @@ in stdenv.mkDerivation (finalAttrs: {
       bluez giflib glib harfbuzz lcms2 libpthreadstubs
       ffmpeg flatbuffers fstrcmp rapidjson
       lirc
-      mesa # for libEGL
+      mesa # uses eglext_angle.h, which is not provided by glvnd
     ]
     ++ lib.optionals x11Support [
       libX11 xorgproto libXt libXmu libXext.dev libXdmcp

pkgs/applications/video/mpv/scripts/mpvacious.nix

@@ -10,13 +10,13 @@
 
 buildLua rec {
   pname = "mpvacious";
-  version = "0.36";
+  version = "0.37";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "sha256-j8K9coa8kyA7AgRQaBXJJmeTpNtfDKkOGnAP9Up7biA=";
+    sha256 = "sha256-sT74uDGtEUSDMJqSTJ6bI9XvdpRnQDNvKebWMx0CRcE=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

pkgs/applications/virtualization/docker/compose.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.31.0";
+  version = "2.32.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-l+xSd7eIpEy6A1mtx3WrcPQl7071IdJkbHKXbe4uFdA=";
+    hash = "sha256-b+HaFXi3Z2vOU2saEvg22uLHbJLdM4dGEZeI6lvI/dk=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-nBexI2hr+lKPe4HCYiNVtmc0Rl5Hhj/+TwSftYWVdQw=";
+  vendorHash = "sha256-AOLAyyg8ZFPjreK/PEY+TJy4puxqMCg5kjEyBfEfmPk=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 

pkgs/applications/virtualization/virtualbox/default.nix

@@ -76,8 +76,8 @@ let
   virtualboxVersion = "7.1.4";
   virtualboxSha256 = "872e7a42b41f8558abbf887f1bdc7aac932bb88b2764d07cbce270cab57e3b5e";
 
-  kvmPatchVersion = "20240828";
-  kvmPatchHash = "sha256-g0esJbB1IGyLGZMLFJIY8ZYdHWuiM5IZtLMHZvCY6bs=";
+  kvmPatchVersion = "20241220";
+  kvmPatchHash = "sha256-SYyD79iN6Sp/Mxat+ml3fee9X1vFUFyrwHPnQNboc1c=";
 
   # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
   # modsrc at all.

pkgs/by-name/be/beszel/0001-fix-build.patch

@@ -1,405 +0,0 @@
-From 402b2d72ad3bcc4a8cdb0115220888154bdb3c39 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Tue, 29 Oct 2024 19:32:07 +0800
-Subject: [PATCH] fix build
-
----
- package-lock.json | 368 ++++++++++++++++++++++++++++++++++
- 1 file changed, 368 insertions(+)
-
-diff --git a/package-lock.json b/package-lock.json
-index 8e4532e..d3b3605 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -679,6 +679,262 @@
- 				"node": ">=6.9.0"
- 			}
- 		},
-+		"node_modules/@esbuild/aix-ppc64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz",
-+			"integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==",
-+			"cpu": [
-+				"ppc64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"aix"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/android-arm": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz",
-+			"integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==",
-+			"cpu": [
-+				"arm"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"android"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/android-arm64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz",
-+			"integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"android"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/android-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz",
-+			"integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"android"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/darwin-arm64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz",
-+			"integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"darwin"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/darwin-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz",
-+			"integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"darwin"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/freebsd-arm64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz",
-+			"integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"freebsd"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/freebsd-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz",
-+			"integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"freebsd"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-arm": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz",
-+			"integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==",
-+			"cpu": [
-+				"arm"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-arm64": {
-+			"version": "0.24.0",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.24.0.tgz",
-+			"integrity": "sha512-TDijPXTOeE3eaMkRYpcy3LarIg13dS9wWHRdwYRnzlwlA370rNdZqbcp0WTyyV/k2zSxfko52+C7jU5F9Tfj1g==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=18"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-ia32": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz",
-+			"integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==",
-+			"cpu": [
-+				"ia32"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-loong64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz",
-+			"integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==",
-+			"cpu": [
-+				"loong64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-mips64el": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz",
-+			"integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==",
-+			"cpu": [
-+				"mips64el"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-ppc64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz",
-+			"integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==",
-+			"cpu": [
-+				"ppc64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-riscv64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz",
-+			"integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==",
-+			"cpu": [
-+				"riscv64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/linux-s390x": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz",
-+			"integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==",
-+			"cpu": [
-+				"s390x"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
- 		"node_modules/@esbuild/linux-x64": {
- 			"version": "0.21.5",
- 			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz",
-@@ -695,6 +951,102 @@
- 				"node": ">=12"
- 			}
- 		},
-+		"node_modules/@esbuild/netbsd-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz",
-+			"integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"netbsd"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/openbsd-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz",
-+			"integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"openbsd"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/sunos-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz",
-+			"integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"sunos"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/win32-arm64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz",
-+			"integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"win32"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/win32-ia32": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz",
-+			"integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==",
-+			"cpu": [
-+				"ia32"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"win32"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
-+		"node_modules/@esbuild/win32-x64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz",
-+			"integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==",
-+			"cpu": [
-+				"x64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"win32"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
- 		"node_modules/@floating-ui/core": {
- 			"version": "1.6.4",
- 			"resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.6.4.tgz",
-@@ -3545,6 +3897,22 @@
- 				"@esbuild/win32-x64": "0.21.5"
- 			}
- 		},
-+		"node_modules/esbuild/node_modules/@esbuild/linux-arm64": {
-+			"version": "0.21.5",
-+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz",
-+			"integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==",
-+			"cpu": [
-+				"arm64"
-+			],
-+			"license": "MIT",
-+			"optional": true,
-+			"os": [
-+				"linux"
-+			],
-+			"engines": {
-+				"node": ">=12"
-+			}
-+		},
- 		"node_modules/escalade": {
- 			"version": "3.1.2",
- 			"resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
--- 
-2.46.1
-

pkgs/by-name/be/beszel/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "beszel";
-  version = "0.6.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-x9HU+sDjxRthC4ROJaKbuKHPHgxFSpyn/dywyGWE/v8=";
+    hash = "sha256-VB3ICoJrBIwP27jZJASQin4xzQ04089VqwFp7hfqZaQ=";
   };
 
   webui = buildNpmPackage {
@@ -28,17 +28,11 @@ buildGoModule rec {
 
     npmFlags = [ "--legacy-peer-deps" ];
 
-    patches = [
-      # add missing @esbuild for multi platform
-      # https://github.com/henrygd/beszel/pull/235
-      # add missing @esbuild for multi platform
-      # https://github.com/henrygd/beszel/pull/235
-      ./0001-fix-build.patch
-    ];
-
     buildPhase = ''
       runHook preBuild
 
+      npx lingui extract --overwrite
+      npx lingui compile
       node --max_old_space_size=1024000 ./node_modules/vite/bin/vite.js build
 
       runHook postBuild
@@ -55,12 +49,12 @@ buildGoModule rec {
 
     sourceRoot = "${src.name}/beszel/site";
 
-    npmDepsHash = "sha256-t7Qcuvqbt0sPHAu3vcZaU8/Ij2yY5/g1TguozlKu0mU=";
+    npmDepsHash = "sha256-ObLulUnCCcKetDW6XKdC8u0NuKBLVUl37jebCGloGoE=";
   };
 
   sourceRoot = "${src.name}/beszel";
 
-  vendorHash = "sha256-/FePQkqoeuH63mV81v1NxpFw9osMUCcZ1bP+0yN1Qlo=";
+  vendorHash = "sha256-yvHsmA4FtENIxKNMS8Bm9bC4dbE64XCX5KP9JYkTtKc=";
 
   preBuild = ''
     mkdir -p site/dist

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -10,7 +10,7 @@
   libcef,
   luajit,
   xorg,
-  mesa,
+  libgbm,
   glib,
   nss,
   nspr,
@@ -56,7 +56,7 @@ let
           xorg.libXext
           xorg.libXfixes
           xorg.libXrandr
-          mesa
+          libgbm
           gtk3
           pango
           cairo
@@ -106,7 +106,7 @@ let
     ];
 
     buildInputs = [
-      mesa
+      libgbm
       xorg.libX11
       xorg.libxcb
       libarchive
@@ -198,7 +198,7 @@ buildFHSEnv {
     ln -s ${bolt}/share/icons/hicolor/256x256/apps/*.png $out/share/icons/hicolor/256x256/apps/
   '';
 
-  runScript = "${bolt.pname}";
+  runScript = "${bolt.name}";
 
   meta = {
     homepage = "https://github.com/Adamcake/Bolt";
@@ -209,6 +209,6 @@ buildFHSEnv {
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ nezia ];
     platforms = lib.platforms.linux;
-    mainProgram = "${bolt.pname}";
+    mainProgram = "${bolt.name}";
   };
 }

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -10,6 +10,7 @@
   pango,
   stdenv,
   olm,
+  nodejs_20,
 }:
 
 buildNpmPackage rec {
@@ -23,6 +24,10 @@ buildNpmPackage rec {
     hash = "sha256-BoUQURCfEu5kocMm8T25cVl8hgZGxcxrMzQZOl2fAbY=";
   };
 
+  # canvas, a transitive dependency of cinny, fails to build with Node 22
+  # https://github.com/Automattic/node-canvas/issues/2448
+  nodejs = nodejs_20;
+
   npmDepsHash = "sha256-fDoia6evCmXZgeIKL0coRo3yunX1dfud31ROgmop2Sc=";
 
   # Fix error: no member named 'aligned_alloc' in the global namespace

pkgs/by-name/ci/circt/package.nix

@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.98.0";
+  version = "1.99.1";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-wkaspxwWJ7xJVQ+VZ9Z85zbzOcLAb3v55EJQjd+jiw8=";
+    hash = "sha256-pnC8BLf2encv7UR10q6rTTpAZ6T0fETwumwTSu+Q8Ro=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -10,40 +10,27 @@
   v2ray-domain-list-community,
   copyDesktopItems,
   makeDesktopItem,
+  libsoup,
 }:
 let
   pname = "clash-verge-rev";
-  version = "1.7.7";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
-    rev = "v${version}";
-    hash = "sha256-5sd0CkUCV52wrBPo0IRIa1uqf2QNkjXuZhE33cZW3SY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QLvJO1JFHPFOsVxNi6SCu2QuJQ9hCsO1+WKOjZL944w=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "e74e419f004275cbf35a427337d3f8c771408f07"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-HyRTOqPj4SnV9gktqRegxOYz9c8mQHOX+IrdZlHhYpo=";
+    rev = "8b676086f2770e213cffea08ef31b54b886f8f11"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-vF26Bp52y2kNHwwtBjy3Of75qJpTriqvul29KmudHww=";
   };
 
-  meta-unwrapped = {
-    description = "Clash GUI based on tauri";
-    homepage = "https://github.com/clash-verge-rev/clash-verge-rev";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      Guanran928
-      bot-wxt1221
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-
-  service-cargo-hash = "sha256-NBeHR6JvdCp06Ug/UEtLY2tu3iCmlsCU0x8umRbJXLU=";
+  service-cargo-hash = "sha256-pMOCifffUyBkcXC8inZFZeZVHeaOt0LAu2jZUGQ7QdM=";
 
   service = callPackage ./service.nix {
     inherit
@@ -51,8 +38,8 @@ let
       src-service
       service-cargo-hash
       pname
+      meta
       ;
-    meta = meta-unwrapped;
   };
 
   webui = callPackage ./webui.nix {
@@ -60,22 +47,24 @@ let
       version
       src
       pname
+      meta
+      npm-hash
       ;
-    meta = meta-unwrapped;
-
   };
 
-  sysproxy-hash = "sha256-TEC51s/viqXUoEH9rJev8LdC2uHqefInNcarxeogePk=";
+  npm-hash = "sha256-zsgZhLC+XUzlCUKKGAJV5MlSpWsoLmAgMwKkmAkAX9Q=";
+  vendor-hash = "sha256-fk3OdJ1CKNHkeUjquJtJgM7PDyPpQ7tssDnFZHMbQHI=";
 
   unwrapped = callPackage ./unwrapped.nix {
     inherit
       pname
       version
       src
-      sysproxy-hash
+      vendor-hash
       webui
+      meta
+      libsoup
       ;
-    meta = meta-unwrapped;
   };
 
   meta = {
@@ -87,10 +76,7 @@ let
       Guanran928
       bot-wxt1221
     ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
+    platforms = lib.platforms.linux;
   };
 in
 stdenv.mkDerivation {

pkgs/by-name/cl/clash-verge-rev/service.nix

@@ -5,7 +5,6 @@
   pkg-config,
   openssl,
   pname,
-  webkitgtk_4_0,
   service-cargo-hash,
   meta,
 }:
@@ -18,12 +17,10 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [
     pkg-config
-    rustPlatform.cargoSetupHook
   ];
 
   buildInputs = [
     openssl
-    webkitgtk_4_0
   ];
 
   env = {

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

@@ -3,13 +3,15 @@
   version,
   src,
   libayatana-appindicator,
-  sysproxy-hash,
+  vendor-hash,
+  glib,
   webui,
   pkg-config,
+  libsoup,
   rustPlatform,
   makeDesktopItem,
   meta,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   openssl,
 }:
 rustPlatform.buildRustPackage {
@@ -17,24 +19,26 @@ rustPlatform.buildRustPackage {
   pname = "${pname}-unwrapped";
   sourceRoot = "${src.name}/src-tauri";
 
-  cargoLock = {
-    lockFile = ./Cargo-tauri.lock;
-    outputHashes = {
-      "sysproxy-0.3.0" = sysproxy-hash;
-    };
-  };
+  useFetchCargoVendor = true;
+  cargoHash = vendor-hash;
 
   env = {
     OPENSSL_NO_VENDOR = 1;
   };
 
   postPatch = ''
-    substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-      --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
-    substituteInPlace ./tauri.conf.json \
-      --replace-fail '"distDir": "../dist",' '"distDir": "${webui}",' \
-      --replace-fail '"beforeBuildCommand": "pnpm run web:build"' '"beforeBuildCommand": ""'
-    sed -i -e '/externalBin/d' -e '/resources/d' tauri.conf.json
+    ls $cargoDepsCopy
+      substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+        --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+
+      substituteInPlace $cargoDepsCopy/sysproxy-*/src/linux.rs \
+        --replace-fail '"gsettings"' '"${glib.bin}/bin/gsettings"'
+
+      substituteInPlace ./tauri.conf.json \
+        --replace-fail '"frontendDist": "../dist",' '"frontendDist": "${webui}",' \
+        --replace-fail '"beforeBuildCommand": "pnpm run web:build"' '"beforeBuildCommand": ""'
+      sed -i -e '/externalBin/d' -e '/resources/d' tauri.conf.json
+      sed -i -e '/sidecar/d' -e '/resources/d' tauri.linux.conf.json
   '';
 
   nativeBuildInputs = [
@@ -44,7 +48,8 @@ rustPlatform.buildRustPackage {
 
   buildInputs = [
     openssl
-    webkitgtk_4_0
+    libsoup
+    webkitgtk_4_1
   ];
 
   postInstall = ''

pkgs/by-name/cl/clash-verge-rev/webui.nix

@@ -6,13 +6,14 @@
   nodejs,
   stdenv,
   meta,
+  npm-hash,
 }:
 stdenv.mkDerivation {
   inherit version src meta;
   pname = "${pname}-webui";
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-ZKDhBdVyLIPf7CQaYUvj9dJd3lA3zsqroSjTyvOmunQ=";
+    hash = npm-hash;
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/code-cursor/package.nix

@@ -8,11 +8,11 @@
 }:
 let
   pname = "cursor";
-  version = "0.43.6";
+  version = "0.44.5";
   appKey = "230313mzl4w4u92";
   src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.43.6-build-241206z7j6me2e2-x86_64.AppImage";
-    hash = "sha256-adEyDExGvxwpvAT0qYiCfvkpINP9BJ6a+LSwQHQ/H/U=";
+    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.5-build-241220s3ux0e1tv-x86_64.AppImage";
+    hash = "sha256-5IbIsOyJdIzDpxOd+CLe8UdxaocJFJckiZvNSuGXtys=";
   };
   appimageContents = appimageTools.extractType2 { inherit version pname src; };
 in
@@ -62,6 +62,7 @@ stdenvNoCC.mkDerivation {
   meta = {
     description = "AI-powered code editor built on vscode";
     homepage = "https://cursor.com";
+    changelog = "https://cursor.com/changelog";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ sarahec ];

pkgs/by-name/cp/cpm-cmake/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cpm-cmake";
-  version = "0.40.2";
+  version = "0.40.3";
 
   src = fetchFromGitHub {
     owner = "cpm-cmake";
     repo = "cpm.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KIRVztkE72juIgXquZlC6AYo78QKHBD7iCvCa+ri66k=";
+    hash = "sha256-3V4XLfhDy6TIOcfSJjkvTRCxo/e5/Kt/+xxAXlZo0XM=";
   };
 
   postPatch = ''

pkgs/by-name/cr/crates-tui/package.nix

@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 let
-  version = "0.1.23";
+  version = "0.1.24";
 in
 rustPlatform.buildRustPackage {
   pname = "crates-tui";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage {
     owner = "ratatui";
     repo = "crates-tui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-d5paevf7bFpC+dZ5fZ5n1F5yFtTWfqrGN4dTkwU0oLQ=";
+    hash = "sha256-yAMVl+3DP9NCjHc9X0qOd6zlJvaY3kcvnVBSS8JHtgU=";
   };
 
-  cargoHash = "sha256-1E77Rz2MjR8NbLFO2oD7JWb5okLmV+/L5DBmHdPrwDg=";
+  cargoHash = "sha256-d79NgOGdxkg6zRpnBlievmPEVWIkY8gYLWdTMpGSPqo=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/cs/csdr/package.nix

@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-LdVzeTTIvDQIXRdcz/vpQu/fUgtE8nx1kIEfoiwxrUg=";
   };
 
+  postPatch = ''
+    # function is not defined in any headers but used in libcsdr.c
+    echo "int errhead();" >> src/predefined.h
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/cw/cwiid/package.nix

@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
     flex
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
   NIX_LDFLAGS = "-lbluetooth";
 
   postInstall = ''

pkgs/by-name/da/dafny/package.nix

@@ -1,12 +1,41 @@
-{ lib
-, buildDotnetModule
-, fetchFromGitHub
-, writeScript
-, jdk11
-, z3
-, dotnetCorePackages
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  runCommand,
+  dafny,
+  writeScript,
+  jdk11,
+  z3,
+  dotnetCorePackages,
 }:
 
+let
+  examples = fetchFromGitHub {
+    owner = "gaberch";
+    repo = "Various-Algorithms-Verified-With-Dafny";
+    rev = "50e451bbcd15e52e27d5bbbf66b0b4c4abbff41c";
+    hash = "sha256-Ng5wve/4gQr/2hsFWUFFcTL3K2xH7dP9w8IrmvWMKyg=";
+  };
+
+  tests = {
+    verify = runCommand "dafny-test" { } ''
+      mkdir $out
+      cp ${examples}/SlowMax.dfy $out
+      ${dafny}/bin/dafny verify --allow-warnings $out/SlowMax.dfy
+    '';
+
+    # Broken, cannot compile generated .cs files for now
+    #run = runCommand "dafny-test" { } ''
+    #    mkdir $out
+    #    cp ${examples}/SlowMax.dfy $out
+    #    ${dafny}/bin/dafny run --allow-warnings $out/SlowMax.dfy
+    #  '';
+
+    # TODO: Ensure then tests that dafny can generate to and compile other
+    # languages (Java, Cpp, etc.)
+  };
+in
 buildDotnetModule rec {
   pname = "Dafny";
   version = "4.8.0";
@@ -24,12 +53,11 @@ buildDotnetModule rec {
       runtimeJarVersion = "4.6.0";
     in
     ''
-      cp ${
-        writeScript "fake-gradlew-for-dafny" ''
-          mkdir -p build/libs/
-          javac $(find -name "*.java" | grep "^./src/main") -d classes
-          jar cf build/libs/DafnyRuntime-${runtimeJarVersion}.jar -C classes dafny
-        ''} Source/DafnyRuntime/DafnyRuntimeJava/gradlew
+      cp ${writeScript "fake-gradlew-for-dafny" ''
+        mkdir -p build/libs/
+        javac $(find -name "*.java" | grep "^./src/main") -d classes
+        jar cf build/libs/DafnyRuntime-${runtimeJarVersion}.jar -C classes dafny
+      ''} Source/DafnyRuntime/DafnyRuntimeJava/gradlew
 
       # Needed to fix
       # "error NETSDK1129: The 'Publish' target is not supported without
@@ -62,6 +90,8 @@ buildDotnetModule rec {
     ln -s "$out/bin/Dafny" "$out/bin/dafny" || true
   '';
 
+  passthru.tests = tests;
+
   meta = with lib; {
     description = "Programming language with built-in specification constructs";
     homepage = "https://research.microsoft.com/dafny";

pkgs/by-name/do/dolibarr/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dolibarr";
-  version = "20.0.0";
+  version = "20.0.2";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
-    rev = version;
-    hash = "sha256-nxytzUEpEo1qeIlpbPQ4mETl5DAAP+d1bqUcYxEW26E=";
+    tag = version;
+    hash = "sha256-5OEZpBxTYXhO27ea/GBmJI9uDLRDgMNc9ehQ7mvvSrY=";
   };
 
   dontBuild = true;
@@ -23,12 +23,12 @@ stdenv.mkDerivation rec {
     find . -type f -name "*.php" -print0 | xargs -0 sed -i 's|/etc/dolibarr|${stateDir}|g'
 
     substituteInPlace htdocs/filefunc.inc.php \
-      --replace '//$conffile = ' '$conffile = ' \
-      --replace '//$conffiletoshow = ' '$conffiletoshow = '
+      --replace-fail '//$conffile = ' '$conffile = ' \
+      --replace-fail '//$conffiletoshow = ' '$conffiletoshow = '
 
     substituteInPlace htdocs/install/inc.php \
-      --replace '//$conffile = ' '$conffile = ' \
-      --replace '//$conffiletoshow = ' '$conffiletoshow = '
+      --replace-fail '//$conffile = ' '$conffile = ' \
+      --replace-fail '//$conffiletoshow = ' '$conffiletoshow = '
   '';
 
   installPhase = ''
@@ -38,10 +38,11 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) dolibarr; };
 
-  meta = with lib; {
+  meta = {
     description = "Enterprise resource planning (ERP) and customer relationship manager (CRM) server";
+    changelog = "https://github.com/Dolibarr/dolibarr/releases/tag/${src.tag}";
     homepage = "https://dolibarr.org/";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
 }

pkgs/by-name/do/dooit-extras/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  python311,
+  dooit,
+  nix-update-script,
+}:
+let
+  python3 = python311;
+in
+python3.pkgs.buildPythonPackage rec {
+  pname = "dooit-extras";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dooit-org";
+    repo = "dooit-extras";
+    tag = "v${version}";
+    hash = "sha256-ZBzzH8k4oC3ovLF9+9rzzFZaDDoOvcbX5NCh1WBedK4=";
+  };
+
+  build-system = with python3.pkgs; [ poetry-core ];
+  buildInputs = [ dooit ];
+
+  # No tests available
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script {
+  };
+
+  meta = with lib; {
+    description = "Extra Utilities for Dooit";
+    homepage = "https://github.com/dooit-org/dooit-extras";
+    changelog = "https://github.com/dooit-org/dooit-extras/blob/${src.tag}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kraanzu
+    ];
+  };
+}

pkgs/by-name/dy/dysk/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dysk";
-  version = "2.9.1";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "dysk";
     rev = "v${version}";
-    hash = "sha256-PGl2pUeLPznut/ETJdaQlin9thDBPvqBE30cgXwV+KM=";
+    hash = "sha256-VJFcdxwj+038d9oj178e0uGQQyKF9JbDytxDmit2tiA=";
   };
 
-  cargoHash = "sha256-ppOAQ6Y9GJNLwGbbg1qfQ7ArVKiYxt26oEEWMOjbu0w=";
+  cargoHash = "sha256-QE7gHHKNKqyMmqovzGR3zKgE7SEzGFkc2mYkBG6V6j0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/el/element-desktop/element-desktop-pin.nix

@@ -0,0 +1,7 @@
+{
+  "version" = "1.11.89";
+  "hashes" = {
+    "desktopSrcHash" = "sha256-vZLM1AIMxDltB+GeQEcYifnaBC1+4wWkotPFuelHxT0=";
+    "desktopYarnHash" = "1n057ic4dzcyg3wfr8jj7vab00jg2d1m38y5zk1kab1pka163f1q";
+  };
+}

pkgs/by-name/el/element-desktop/keytar/default.nix

@@ -8,8 +8,6 @@
   pkg-config,
   libsecret,
   xcbuild,
-  Security,
-  AppKit,
   fetchNpmDeps,
   npmHooks,
 }:
@@ -36,12 +34,7 @@ stdenv.mkDerivation rec {
     npmHooks.npmConfigHook
   ] ++ lib.optional stdenv.hostPlatform.isDarwin xcbuild;
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      AppKit
-    ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ];
 
   npmDeps = fetchNpmDeps {
     inherit src;

pkgs/by-name/el/element-desktop/package.nix

@@ -13,9 +13,6 @@
   element-web,
   sqlcipher,
   callPackage,
-  Security,
-  AppKit,
-  CoreServices,
   desktopToDarwinBundle,
   useKeytar ? true,
   # command line arguments which are always set
@@ -23,11 +20,11 @@
 }:
 
 let
-  pinData = import ./pin.nix;
+  pinData = import ./element-desktop-pin.nix;
   inherit (pinData.hashes) desktopSrcHash desktopYarnHash;
   executableName = "element-desktop";
-  keytar = callPackage ./keytar { inherit Security AppKit; };
-  seshat = callPackage ./seshat { inherit CoreServices; };
+  keytar = callPackage ./keytar { };
+  seshat = callPackage ./seshat { };
   electron = electron_33;
 in
 stdenv.mkDerivation (
@@ -146,6 +143,7 @@ stdenv.mkDerivation (
     '';
 
     passthru = {
+      # run with: nix-shell ./maintainers/scripts/update.nix --argstr package element-desktop
       updateScript = ./update.sh;
 
       # TL;DR: keytar is optional while seshat isn't.

pkgs/by-name/el/element-desktop/seshat/default.nix

@@ -3,13 +3,11 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  rust,
   sqlcipher,
   nodejs,
   python3,
   yarn,
   fixup-yarn-lock,
-  CoreServices,
   fetchYarnDeps,
   removeReferencesTo,
 }:
@@ -37,7 +35,7 @@ rustPlatform.buildRustPackage rec {
     yarn
     fixup-yarn-lock
   ];
-  buildInputs = [ sqlcipher ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices;
+  buildInputs = [ sqlcipher ];
 
   npm_config_nodedir = nodejs;
 

pkgs/by-name/el/element-desktop/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq
+#!nix-shell -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq
 
 if [ "$#" -gt 1 ] || [[ "$1" == -* ]]; then
   echo "Regenerates packaging data for the element packages."
@@ -22,6 +22,8 @@ version="${version#v}"
 web_src="https://raw.githubusercontent.com/element-hq/element-web/v$version"
 web_src_hash=$(nix-prefetch-github element-hq element-web --rev v${version} | jq -r .hash)
 
+cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
+
 web_tmpdir=$(mktemp -d)
 trap 'rm -rf "$web_tmpdir"' EXIT
 
@@ -42,14 +44,22 @@ wget -q "$desktop_src/yarn.lock"
 desktop_yarn_hash=$(prefetch-yarn-deps yarn.lock)
 popd
 
-cat > pin.nix << EOF
+cat > ../element-web-unwrapped/element-web-pin.nix << EOF
 {
   "version" = "$version";
   "hashes" = {
-    "desktopSrcHash" = "$desktop_src_hash";
-    "desktopYarnHash" = "$desktop_yarn_hash";
     "webSrcHash" = "$web_src_hash";
     "webYarnHash" = "$web_yarn_hash";
   };
 }
 EOF
+
+cat > element-desktop-pin.nix << EOF
+{
+  "version" = "$version";
+  "hashes" = {
+    "desktopSrcHash" = "$desktop_src_hash";
+    "desktopYarnHash" = "$desktop_yarn_hash";
+  };
+}
+EOF

pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix

@@ -0,0 +1,7 @@
+{
+  "version" = "1.11.89";
+  "hashes" = {
+    "webSrcHash" = "sha256-K9i5MxTJaX359qsnpfXZBZiNHbhCEy25plUPVUtbGQs=";
+    "webYarnHash" = "164smvrq9937x0pql20zdqab5w35fcidbywkzlyc5g4w7iwkd9kx";
+  };
+}

pkgs/by-name/el/element-web-unwrapped/package.nix

@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  jq,
+  yarn,
+  fixup-yarn-lock,
+  nodejs,
+  jitsi-meet,
+}:
+
+let
+  pinData = import ./element-web-pin.nix;
+  inherit (pinData.hashes) webSrcHash webYarnHash;
+  noPhoningHome = {
+    disable_guests = true; # disable automatic guest account registration at matrix.org
+  };
+in
+stdenv.mkDerivation (
+  finalAttrs:
+  builtins.removeAttrs pinData [ "hashes" ]
+  // {
+    pname = "element-web";
+
+    src = fetchFromGitHub {
+      owner = "element-hq";
+      repo = "element-web";
+      rev = "v${finalAttrs.version}";
+      hash = webSrcHash;
+    };
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = finalAttrs.src + "/yarn.lock";
+      sha256 = webYarnHash;
+    };
+
+    nativeBuildInputs = [
+      yarn
+      fixup-yarn-lock
+      jq
+      nodejs
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      export VERSION=${finalAttrs.version}
+      yarn --offline build:res
+      yarn --offline build:module_system
+      yarn --offline build:bundle
+
+      runHook postBuild
+    '';
+
+    configurePhase = ''
+      runHook preConfigure
+
+      export HOME=$PWD/tmp
+      # with the update of openssl3, some key ciphers are not supported anymore
+      # this flag will allow those codecs again as a workaround
+      # see https://medium.com/the-node-js-collection/node-js-17-is-here-8dba1e14e382#5f07
+      # and https://github.com/element-hq/element-web/issues/21043
+      export NODE_OPTIONS=--openssl-legacy-provider
+      mkdir -p $HOME
+
+      fixup-yarn-lock yarn.lock
+      yarn config --offline set yarn-offline-mirror $offlineCache
+      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+      patchShebangs node_modules
+
+      runHook postConfigure
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -R webapp $out
+      tar --extract --to-stdout --file ${jitsi-meet.src} jitsi-meet/libs/external_api.min.js > $out/jitsi_external_api.min.js
+      echo "${finalAttrs.version}" > "$out/version"
+      jq -s '.[0] * $conf' "config.sample.json" --argjson "conf" '${builtins.toJSON noPhoningHome}' > "$out/config.json"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Glossy Matrix collaboration client for the web";
+      homepage = "https://element.io/";
+      changelog = "https://github.com/element-hq/element-web/blob/v${finalAttrs.version}/CHANGELOG.md";
+      maintainers = lib.teams.matrix.members;
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+    };
+  }
+)

pkgs/by-name/ex/exo/package.nix

@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "exo";
-  version = "0-unstable-2024-12-07";
+  version = "0-unstable-2024-12-15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "exo-explore";
     repo = "exo";
-    rev = "db9de97fa6ecef51d1b7eec6758b55c402da786e";
-    hash = "sha256-1tChxxP8saeBjLsOpL8GYCNyhlXkN2Mg2LruyB3K3/g=";
+    rev = "cfedcec3a651f27085e1913f4bd42a699fa82076";
+    hash = "sha256-OPGWmIfIVW/1lJg+4iXRvzN6bY8+LzWx8SOgBUXjPQ0=";
   };
 
   build-system = with python3Packages; [ setuptools ];

pkgs/by-name/fa/faas-cli/package.nix

@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.37";
+  version = "0.16.38";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-DGtIoX0cvhnHYD+xBV6lW703onupLpF/QYH75rt23Q4=";
+    sha256 = "sha256-X+lPky5oR+ngQ4nRePU0FzMBjJQinhSadoVsXeXzr+Q=";
   };
 
   vendorHash = null;

pkgs/by-name/fa/factorio/versions.json

@@ -3,38 +3,37 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.23.tar.xz"
+          "factorio_linux_2.0.28.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.23.tar.xz",
+        "name": "factorio_alpha_x64-2.0.28.tar.xz",
         "needsAuth": true,
-        "sha256": "3a3f27a5364d33896c8b35d352d0d2d6086b4ba98627eda71b26e57127309bfb",
+        "sha256": "d3acf17e4ca56e3332e920a015d5ca53aea73088460c8b2f67e04b04e7b912bb",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/alpha/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/alpha/linux64",
+        "version": "2.0.28"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.23.tar.xz"
+          "factorio_linux_2.0.28.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.23.tar.xz",
+        "name": "factorio_alpha_x64-2.0.28.tar.xz",
         "needsAuth": true,
-        "sha256": "3a3f27a5364d33896c8b35d352d0d2d6086b4ba98627eda71b26e57127309bfb",
+        "sha256": "d3acf17e4ca56e3332e920a015d5ca53aea73088460c8b2f67e04b04e7b912bb",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/alpha/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/alpha/linux64",
+        "version": "2.0.28"
       }
     },
     "demo": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_demo_x64_1.1.110.tar.xz"
+          "factorio_demo_x64_2.0.27.tar.xz"
         ],
-        "name": "factorio_demo_x64-1.1.110.tar.xz",
+        "name": "factorio_demo_x64-2.0.27.tar.xz",
         "needsAuth": false,
-        "sha256": "bddb91dcba9f300c25d590f861772eaf41f0b6ce8ae6b754de00d0e5f3eb5a35",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.110/demo/linux64",
-        "version": "1.1.110"
+        "url": "https://factorio.com/get-download/2.0.27/demo/linux64",
+        "version": "2.0.27"
       },
       "stable": {
         "candidateHashFilenames": [
@@ -51,51 +50,51 @@
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.23.tar.xz"
+          "factorio-space-age_linux_2.0.28.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.23.tar.xz",
+        "name": "factorio_expansion_x64-2.0.28.tar.xz",
         "needsAuth": true,
-        "sha256": "8c6bb2c3afd198b8d5e1042f2babcb2db2d55645d1e84d9cfbba77cd83ae9e6a",
+        "sha256": "e3eee33c439abaffa305dd5c86edea97fbaa2a2b34c368cae3595c1d5d22739e",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/expansion/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/expansion/linux64",
+        "version": "2.0.28"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.23.tar.xz"
+          "factorio-space-age_linux_2.0.28.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.23.tar.xz",
+        "name": "factorio_expansion_x64-2.0.28.tar.xz",
         "needsAuth": true,
-        "sha256": "8c6bb2c3afd198b8d5e1042f2babcb2db2d55645d1e84d9cfbba77cd83ae9e6a",
+        "sha256": "e3eee33c439abaffa305dd5c86edea97fbaa2a2b34c368cae3595c1d5d22739e",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/expansion/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/expansion/linux64",
+        "version": "2.0.28"
       }
     },
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.23.tar.xz",
-          "factorio_headless_x64_2.0.23.tar.xz"
+          "factorio-headless_linux_2.0.28.tar.xz",
+          "factorio_headless_x64_2.0.28.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.23.tar.xz",
+        "name": "factorio_headless_x64-2.0.28.tar.xz",
         "needsAuth": false,
-        "sha256": "e819fc9ad6df061bf9d4bffc91988dd18d0e3982c8b1c22c0525d78bda3ef216",
+        "sha256": "ea9937b6adc7a18e17a4e1e64992ec389407497b36e68280bb14fcdd4c884dd3",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/headless/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/headless/linux64",
+        "version": "2.0.28"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.23.tar.xz",
-          "factorio_headless_x64_2.0.23.tar.xz"
+          "factorio-headless_linux_2.0.28.tar.xz",
+          "factorio_headless_x64_2.0.28.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.23.tar.xz",
+        "name": "factorio_headless_x64-2.0.28.tar.xz",
         "needsAuth": false,
-        "sha256": "e819fc9ad6df061bf9d4bffc91988dd18d0e3982c8b1c22c0525d78bda3ef216",
+        "sha256": "ea9937b6adc7a18e17a4e1e64992ec389407497b36e68280bb14fcdd4c884dd3",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.23/headless/linux64",
-        "version": "2.0.23"
+        "url": "https://factorio.com/get-download/2.0.28/headless/linux64",
+        "version": "2.0.28"
       }
     }
   }

pkgs/by-name/fi/firebase-tools/package.nix

@@ -8,19 +8,19 @@
 }:
 
 let
-  version = "13.28.0";
+  version = "13.29.1";
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bOuOBzEEfVi+0lGqKgZQVmxKUBWoWWdaQ1jlCR1xBcM=";
+    hash = "sha256-j6luT+L/vN9qaGjjeMW+8QGuzjJxzbn0sMGDjhqoeZA=";
   };
 in
 buildNpmPackage {
   pname = "firebase-tools";
   inherit version src;
 
-  npmDepsHash = "sha256-3wc1DPZ+yYlBtUTWpa4XFaetS7caNqX5JFSXkmzHyqg=";
+  npmDepsHash = "sha256-3+XeXK3VGIs4Foi9iW9Kho/Y0JsTQZ7p+582MPgdH1A=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/by-name/fi/firecracker/package.nix

@@ -1,59 +1,72 @@
 {
-  fetchurl,
   lib,
   stdenv,
+  fetchFromGitHub,
+  makeRustPlatform,
+  rustc,
+  cargo,
+  llvmPackages,
+  cmake,
+  gcc,
+
+  # gcc compile error at deps: aws-lc-sys, function 'memcpy' inlined from 'OPENSSL_memcpy'
+  # error: '__builtin_memcpy' specified bound exceeds maximum object size
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91397
+  useRustPlatform ? makeRustPlatform {
+    inherit rustc cargo;
+    inherit (llvmPackages) stdenv;
+  },
 }:
 
-let
-  version = "1.9.0";
-  # nixpkgs-update: no auto update
-
-  suffix =
-    {
-      x86_64-linux = "x86_64";
-      aarch64-linux = "aarch64";
-    }
-    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  baseurl = "https://github.com/firecracker-microvm/firecracker/releases/download";
-
-  dlbin =
-    hash:
-    fetchurl {
-      url = "${baseurl}/v${version}/firecracker-v${version}-${suffix}.tgz";
-      hash =
-        hash."${stdenv.hostPlatform.system}" or (throw "unsupported system ${stdenv.hostPlatform.system}");
-    };
-
-in
-stdenv.mkDerivation {
+useRustPlatform.buildRustPackage rec {
   pname = "firecracker";
-  inherit version;
+  version = "1.9.1";
 
-  sourceRoot = ".";
-  src = dlbin {
-    x86_64-linux = "sha256-lcE3QMfKGm37QOD1HNCp7v7h8iPNLDU4dV0Dw6m6Ujc=";
-    aarch64-linux = "sha256-xVZOdt7CuOgJLFLw+KTF9FzzF5HpWpMC9DYKdx33j2k=";
+  src = fetchFromGitHub {
+    owner = "firecracker-microvm";
+    repo = "firecracker";
+    rev = "v${version}";
+    hash = "sha256-NgT06Xfb6j+d5EcqFjQeaiY08uJJjmrddzdwSoqpKbQ=";
   };
 
-  dontConfigure = true;
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "micro_http-0.1.0" = "sha256-bso39jUUyhlNutUxHw8uHtKWQIHmoikfQ5O3RIePboo=";
+    };
+  };
 
-  buildPhase = ''
-    mv release-v${version}-${suffix}/firecracker-v${version}-${suffix} firecracker
-    mv release-v${version}-${suffix}/jailer-v${version}-${suffix} jailer
-    chmod +x firecracker jailer
-  '';
+  nativeBuildInputs = [
+    cmake
+    gcc
+    useRustPlatform.bindgenHook
+  ];
 
-  doCheck = true;
-  checkPhase = ''
-    ./firecracker --version
-    ./jailer --version
-  '';
+  cargoBuildFlags = [ "--workspace" ];
+
+  checkFlags = [
+    # requires /sys/devices/virtual/dmi
+    "--skip=fingerprint::dump::tests::test_read_valid_sysfs_file"
+    # requires /dev/kvm
+    "--skip=template::dump::tests::test_dump"
+    "--skip=tests::test_fingerprint_dump_command"
+    "--skip=tests::test_template_dump_command"
+    "--skip=tests::test_template_verify_command"
+    "--skip=utils::tests::test_build_microvm"
+    # requires seccomp == 0
+    "--skip=tests::test_filter_apply"
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
-    install -D firecracker $out/bin/firecracker
-    install -D jailer      $out/bin/jailer
+    releaseDir="build/cargo_target/${stdenv.hostPlatform.rust.rustcTarget}/release"
+    for bin in $(find $releaseDir -maxdepth 1 -type f -executable); do
+      install -Dm555 -t $out/bin $bin
+    done
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -62,11 +75,9 @@ stdenv.mkDerivation {
     changelog = "https://github.com/firecracker-microvm/firecracker/releases/tag/v${version}";
     mainProgram = "firecracker";
     license = licenses.asl20;
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
+    platforms = lib.platforms.linux;
     maintainers = with maintainers; [
+      usertam
       thoughtpolice
       qjoly
       techknowlogick

pkgs/by-name/fm/fmtoy/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fmtoy";
-  version = "0-unstable-2024-11-13";
+  version = "0-unstable-2024-12-15";
 
   src = fetchFromGitHub {
     owner = "vampirefrog";
     repo = "fmtoy";
-    rev = "6bf6a72bf35afd2fb3bdf17a97553d122751e391";
+    rev = "6858fc8ad3171df2c9b90cb1e62719af9fc4f7c2";
     fetchSubmodules = true;
-    hash = "sha256-aAZUCI711d0FqKYcEIiEClH3hMcUzMzXF3XflpTTrjM=";
+    hash = "sha256-OiPKtFPlTxdMNSTLJXcXZkqjzUiGQKXSF2udHePBpho=";
   };
 
   postPatch = ''

pkgs/by-name/fo/foliate/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "foliate";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "johnfactotum";
     repo = "foliate";
     rev = "refs/tags/${version}";
-    hash = "sha256-y4c/nlFk0hlr773/O2yvW7VzUx0NZWpcDtk8b9wlL2s=";
+    hash = "sha256-NU4lM+J5Tpd9Fl+eVbBy7WnCQ6LJ7oeWVkBxp6euTHU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/fs/fscan/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "fscan";
-  version = "1.8.4";
+  version = "2.0.0-build1";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     rev = version;
-    hash = "sha256-5uFSvEkTBy0veMdeeg9BmSqu+qSqCwuozK0J3kerAdE=";
+    hash = "sha256-ZJVdjdON7qgjxWU8/eOsmct0g/xr77fEH3PfV4JUOdw=";
   };
 
-  vendorHash = "sha256-FFYqvGEFe7sUEb4G3ApQOuYoiDXeA54P7spmKfRiEF0=";
+  vendorHash = "sha256-WDq08flKiMCN4SS9xHH3B0nCX6us6huX8SF9BPuNzoo=";
 
   meta = with lib; {
     description = "Intranet comprehensive scanning tool";

pkgs/by-name/ga/gatus/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gatus";
-  version = "5.13.1";
+  version = "5.14.0";
 
   src = fetchFromGitHub {
     owner = "TwiN";
     repo = "gatus";
     rev = "v${version}";
-    hash = "sha256-OY8f4FGlWeE5Jg4ESnVGo/oiTBVavBSXdGKB+uceC7U=";
+    hash = "sha256-WYD456l1XdyqhBzsMvruvn24DYspCYt9m7rzqd3dSK4=";
   };
 
-  vendorHash = "sha256-FAlf+tGI3ssugHf8PsNc2Fb+rH8MqgS3BWXaee+khZw=";
+  vendorHash = "sha256-UeKQwqDHj1DFjlnGAl8asW7OpmClGi9aB/IbMzR9WvU=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ge/gepetto-viewer/package.nix

@@ -20,13 +20,13 @@
 let
   gepetto-viewer = stdenv.mkDerivation (finalAttrs: {
     pname = "gepetto-viewer";
-    version = "5.2.0";
+    version = "6.0.0";
 
     src = fetchFromGitHub {
       owner = "gepetto";
       repo = "gepetto-viewer";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-kAQPi7bO48H0CZKz1bxfkvMiNy8RsXvRvpDK0KF7XLM=";
+      hash = "sha256-nbA+JNogtlktkByUD2Urx3kJpe/8jgIjO59XXOAPpNs=";
     };
 
     cmakeFlags = [

pkgs/by-name/gh/gh-dash/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "4.7.3";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-QDqGsVgY3Je1VgQVobDhNkVjrCyvMNEdghXc0ny+yyo=";
+    hash = "sha256-0LiuEhp1caTdROBvkqEpI80y3s5zW3jIUTEKtY2OD0o=";
   };
 
   vendorHash = "sha256-lqmz+6Cr9U5IBoJ5OeSN6HKY/nKSAmszfvifzbxG7NE=";

pkgs/by-name/gh/gh-gei/deps.json

@@ -2,161 +2,161 @@
   {
     "pname": "AWSSDK.Core",
     "version": "3.7.300.11",
-    "sha256": "1460yndb9gfy4qx36g4lxaqxzb3p19kfqp7czi28i1p7z7nh38vi"
+    "hash": "sha256-caMB7fnnhohE/Oxc7GYKd6zfseqUPDM6Jt69tJr1wJA="
   },
   {
     "pname": "AWSSDK.S3",
     "version": "3.7.304",
-    "sha256": "0hjls7477rm3g7bvd8m7ch37lmllnsv71x1lhjjn8g2nk7d3lk0q"
+    "hash": "sha256-GEw62plWPGSlhDT0cLa2lFZ6BmSnorbXeaPmc8jRVEI="
   },
   {
     "pname": "Azure.Core",
     "version": "1.36.0",
-    "sha256": "14lsc6zik7s5by3gp86pf77wh58fcqrjy2xhx5p03gmhdn6iz2cn"
+    "hash": "sha256-lokfjW2wvgFu6bALLzNmDhXIz3HXoPuGX0WfGb9hmpI="
   },
   {
     "pname": "Azure.Storage.Blobs",
     "version": "12.19.1",
-    "sha256": "0rdgvlbqkcyc356xs0wzwbm92lf95621mf2shk30i3ahp0k0gd0k"
+    "hash": "sha256-E7QHJrhQjQjGhFq4GoQpyVGR6uKfA91NGcyziRfdr2U="
   },
   {
     "pname": "Azure.Storage.Common",
     "version": "12.18.1",
-    "sha256": "1hjzggfv24598601jhcdfcaflbd5b97aglhxy7a5ymy1aszhwp9k"
+    "hash": "sha256-M10Ov1bBV1/U8R3Sp05apS3qFHONQRmAQakQsd17X8I="
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "1.1.1",
-    "sha256": "0a1ahssqds2ympr7s4xcxv5y8jgxs7ahd6ah6fbgglj4rki1f1vw"
+    "hash": "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "6.0.0",
-    "sha256": "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"
+    "hash": "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Analyzers",
     "version": "3.3.4",
-    "sha256": "0wd6v57p53ahz5z9zg4iyzmy3src7rlsncyqpcag02jjj1yx6g58"
+    "hash": "sha256-qDzTfZBSCvAUu9gzq2k+LOvh6/eRvJ9++VCNck/ZpnE="
   },
   {
     "pname": "Microsoft.CodeAnalysis.Common",
     "version": "4.7.0",
-    "sha256": "1zj4wwsad2j7y1byigm3c386rv56xr05mwxjlgqh0h0n5w5yjc4w"
+    "hash": "sha256-nDDpCy8WQADxo7LzWkDupuxs0GCjvuhX8EeKpjTnRP4="
   },
   {
     "pname": "Microsoft.CodeAnalysis.CSharp",
     "version": "4.7.0",
-    "sha256": "1lz3ha3pp58hd4y031z64slcf9rh7g1cgkrlrbhi4vpa67xhynnh"
+    "hash": "sha256-0FoP+zHqbhLhyjTPx8I7MCfHqCbmhwE8aRCVe4eC49M="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
     "version": "7.0.0",
-    "sha256": "121zs4jp8iimgbpzm3wsglhjwkc06irg1pxy8c1zcdlsg34cfq1p"
+    "hash": "sha256-N2DHyHiaNvYDQ77f8HI0gE0uIX2aj/rvejVGdCXRP4g="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
     "version": "7.0.0",
-    "sha256": "181d7mp9307fs17lyy42f8cxnjwysddmpsalky4m0pqxcimnr6g7"
+    "hash": "sha256-55lsa2QdX1CJn1TpW1vTnkvbGXKCeE9P0O6AkW49LaA="
   },
   {
     "pname": "Microsoft.Extensions.Http",
     "version": "7.0.0",
-    "sha256": "196b13zkkq0fhfgigkhwcw1hhaj4dj5pc27z7d5niaizzx6ycwiw"
+    "hash": "sha256-PHLmTf8/qmhLO/8IdotsRCoIA2cczhefgw7gOf8Iy6Q="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
     "version": "7.0.0",
-    "sha256": "1bqd3pqn5dacgnkq0grc17cgb2i0w8z1raw12nwm3p3zhrfcvgxf"
+    "hash": "sha256-rr/NXIZ/3FG5FYGrHD7iIIr12AksP4CnfUy1YvEdDa8="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
     "version": "7.0.0",
-    "sha256": "1gn7d18i1wfy13vrwhmdv1rmsb4vrk26kqdld4cgvh77yigj90xs"
+    "hash": "sha256-uoMkX/TnwP0YabThacTMmyxdc9itQp73CN7xEFFox74="
   },
   {
     "pname": "Microsoft.Extensions.Options",
     "version": "7.0.0",
-    "sha256": "0b90zkrsk5dw3wr749rbynhpxlg4bgqdnd7d5vdlw2g9c7zlhgx6"
+    "hash": "sha256-pj9I/2HpCU7bLu002/Bb5NF+ofUrJ3IyH7yVqfP8IC0="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
     "version": "7.0.0",
-    "sha256": "1b4km9fszid9vp2zb3gya5ni9fn8bq62bzaas2ck2r7gs0sdys80"
+    "hash": "sha256-AGnfNNDvZDGZ0Er9JQxeyLoUbVH+jfXF3anFr12qk6w="
   },
   {
     "pname": "Newtonsoft.Json",
     "version": "13.0.3",
-    "sha256": "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"
+    "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
   },
   {
     "pname": "Polly",
     "version": "7.2.4",
-    "sha256": "0lvhi2a18p6ay780lbw18656297s9i45cvpp4dr9k5lhg7fwl2y1"
+    "hash": "sha256-wQvK3XmQlplyI/duVkhM+iRhikGBLwrQ8cpcFJSIcFM="
   },
   {
     "pname": "System.Collections.Immutable",
     "version": "7.0.0",
-    "sha256": "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"
+    "hash": "sha256-9an2wbxue2qrtugYES9awshQg+KfJqajhnhs45kQIdk="
   },
   {
     "pname": "System.CommandLine",
     "version": "2.0.0-beta4.22272.1",
-    "sha256": "1iy5hwwgvx911g3yq65p4zsgpy08w4qz9j3h0igcf7yci44vw8yd"
+    "hash": "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="
   },
   {
     "pname": "System.CommandLine.NamingConventionBinder",
     "version": "2.0.0-beta4.22272.1",
-    "sha256": "07hcz8jcqla4fs7cd2r0lanqsa13nl9l37spby9bc5p2apkyrz0m"
+    "hash": "sha256-Ffzs51XiFraSX1efQRO1IyiNraIgi8aOdkRRzCT6DB4="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
     "version": "6.0.1",
-    "sha256": "17h8bkcv0vf9a7gp9ajkd107zid98wql5kzlzwrjm5nm92nk0bsy"
+    "hash": "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4="
   },
   {
     "pname": "System.IO.Hashing",
     "version": "6.0.0",
-    "sha256": "0lga30s3cllg2jkwldgabwrb0jg3dzj859bwj95xhnm3zcklnb41"
+    "hash": "sha256-gSxLJ/ujWthLknylguRv40mwMl/qNcqnFI9SNjQY6lE="
   },
   {
     "pname": "System.Linq.Async",
     "version": "6.0.1",
-    "sha256": "10ira8hmv0i54yp9ggrrdm1c06j538sijfjpn1kmnh9j2xk5yzmq"
+    "hash": "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="
   },
   {
     "pname": "System.Memory.Data",
     "version": "1.0.2",
-    "sha256": "1p8qdg0gzxhjvabryc3xws2629pj8w5zz2iqh86kw8sh0rann9ay"
+    "hash": "sha256-XiVrVQZQIz4NgjiK/wtH8iZhhOZ9MJ+X2hL2/8BrGN0="
   },
   {
     "pname": "System.Numerics.Vectors",
     "version": "4.5.0",
-    "sha256": "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"
+    "hash": "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="
   },
   {
     "pname": "System.Reflection.Metadata",
     "version": "7.0.0",
-    "sha256": "1wilasn2qmj870h2bhw348lspamm7pbinpb4m89icg113510l00v"
+    "hash": "sha256-GwAKQhkhPBYTqmRdG9c9taqrKSKDwyUgOEhWLKxWNPI="
   },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "6.0.0",
-    "sha256": "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"
+    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
   },
   {
     "pname": "System.Text.Encodings.Web",
     "version": "4.7.2",
-    "sha256": "0ap286ykazrl42if59bxhzv81safdfrrmfqr3112siwyajx4wih9"
+    "hash": "sha256-CUZOulSeRy1CGBm7mrNrTumA9od9peKiIDR/Nb1B4io="
   },
   {
     "pname": "System.Text.Json",
     "version": "4.7.2",
-    "sha256": "10xj1pw2dgd42anikvj9qm23ccssrcp7dpznpj4j7xjp1ikhy3y4"
+    "hash": "sha256-xA8PZwxX9iOJvPbfdi7LWjM2RMVJ7hmtEqS9JvgNsoM="
   },
   {
     "pname": "System.Threading.Tasks.Extensions",
     "version": "4.5.4",
-    "sha256": "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"
+    "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
   }
 ]

pkgs/by-name/gh/gh-gei/package.nix

@@ -6,16 +6,16 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.9.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6lEEeAYrMB9wwATsORuaS21wLOB+gq/od88FobSse50=";
+    hash = "sha256-hUURXPKhiI3n1BrW8IzVVmPuJyO4AxM8D5uluaJXk+4=";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
   projectFile = "src/gei/gei.csproj";
   nugetDeps = ./deps.json; # File generated with `nix-build -A gh-gei.passthru.fetch-deps`.
 

pkgs/by-name/gh/gh/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.63.2";
+  version = "2.64.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MxgwnRTIJFpYhZZhyc59ZAzgi6ud7mHpdSIImMlkwtg=";
+    hash = "sha256-5OdUA0rwBUjfoUZfXzFBmt/GFuvH3pm8JV2iLhaJQek=";
   };
 
-  vendorHash = "sha256-UCEtvEpfoyJs5lpoAfMehg5cFQ3XlESRT8XFIwvyYas=";
+  vendorHash = "sha256-lMhSJSQHCY/bDeFM2L2Dfo4ApkjTkg8R0PwOpGr+Gi0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/gi/git-repo/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.49.3";
+  version = "2.50.1";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    hash = "sha256-DZtwQQg8jyanRx5JKYLTsn4v7IBJBIl9yQemVOioCPY=";
+    hash = "sha256-HJdXdFaC8yFef2gMJpSfZ2TDxEZkZLWZcum41dfG/DQ=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'

pkgs/by-name/gl/glab/package.nix

@@ -4,20 +4,21 @@
   fetchFromGitLab,
   installShellFiles,
   stdenv,
+  nix-update-script,
 }:
 
 buildGo123Module rec {
   pname = "glab";
-  version = "1.50.0";
+  version = "1.51.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-WQO+9Fmlzj21UPJ9cdFc6JC8mbkzOWxz077JR+11BXA=";
+    hash = "sha256-EWcoEm6DbRT0PP2qYhdwDHCkbeAG6vDVATPhX9pPfiw=";
   };
 
-  vendorHash = "sha256-nwHY0221nacHk4M+RKA8BEJLCoJJdIKwP0ZPjhYxc7Q=";
+  vendorHash = "sha256-f6qAFeB9kshtQ2AW6OnEGSnhJYlJ2gAGRDplVmQSVNA=";
 
   ldflags = [
     "-s"
@@ -43,6 +44,8 @@ buildGo123Module rec {
       --zsh <($out/bin/glab completion -s zsh)
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "GitLab CLI tool bringing GitLab to your command line";
     license = lib.licenses.mit;

pkgs/by-name/go/goat-cli/mock-fix.patch

@@ -0,0 +1,12 @@
+diff --git a/pkg/goatfile/unmarshal_test.go b/pkg/goatfile/unmarshal_test.go
+index 089e89f..5b4191b 100644
+--- a/pkg/goatfile/unmarshal_test.go
++++ b/pkg/goatfile/unmarshal_test.go
+@@ -8,7 +8,6 @@ import (
+ 
+ 	"github.com/golang/mock/gomock"
+ 	"github.com/stretchr/testify/assert"
+-	"github.com/studio-b12/goat/mocks"
+ 	"github.com/studio-b12/goat/pkg/set"
+ )
+ 

pkgs/by-name/go/goat-cli/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  fetchpatch,
+}:
+
+buildGoModule rec {
+  pname = "goat-cli";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    repo = "goat";
+    owner = "studio-b12";
+    rev = "v${version}";
+    hash = "sha256-H7ea3XOBfQ7bIX5SbxPd+fcSlMurSWXGXe+/LsqSc0A=";
+  };
+
+  vendorHash = "sha256-DtEXgGYSkWO876so6LEOkhVwDt/zrflDZdY4O2lz1mw=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/studio-b12/goat/internal/version.Version=${version}"
+    "-X github.com/studio-b12/goat/internal/version.CommitHash=${src.rev}"
+  ];
+
+  patches = [
+    ./mock-fix.patch
+  ];
+
+  # Checks currently fail because of an issue with github.com/studio-b12/goat/mocks
+  doCheck = false;
+
+  meta = {
+    description = "Integration testing tool for HTTP APIs using a simple script language";
+    homepage = "https://studio-b12.github.io/goat/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ kashw2 ];
+    mainProgram = "goat";
+  };
+
+}

pkgs/by-name/go/golem/package.nix

@@ -20,13 +20,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "golem";
-  version = "1.0.27";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "golemcloud";
     repo = "golem";
     tag = "v${version}";
-    hash = "sha256-H8Dykn079107gZTV2w/T/gyIVxJtV8NuhuCM2+46yyI=";
+    hash = "sha256-6AUUgXWlDaoI16p/Hrl115XMGYUIDD5YWHX6JfDk9SI=";
   };
 
   # Taker from https://github.com/golemcloud/golem/blob/v1.0.26/Makefile.toml#L399
@@ -53,13 +53,13 @@ rustPlatform.buildRustPackage rec {
 
   # Required for golem-wasm-rpc's build.rs to find the required protobuf files
   # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
-  GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.0.1";
+  GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.1.0";
   # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
   # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
-  GOLEM_WIT_ROOT = "../golem-wit-1.0.3";
+  GOLEM_WIT_ROOT = "../golem-wit-1.1.0";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GrZhWcm7id8pRrwHRDt5k1tcVnoePO8eCWCHzkhCsZk=";
+  cargoHash = "sha256-zf/L7aNsfQXCdGpzvBZxgoatAGB92bvIuj59jANrXIc=";
 
   # Tests are failing in the sandbox because of some redis integration tests
   doCheck = false;
@@ -78,9 +78,10 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Open source durable computing platform that makes it easy to build and deploy highly reliable distributed systems";
-    changelog = "https://github.com/golemcloud/golem/releases/tag/v${version}";
+    changelog = "https://github.com/golemcloud/golem/releases/tag/${src.tag}";
     homepage = "https://www.golem.cloud/";
     license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kmatasfp ];
     mainProgram = "golem-cli";
   };
 }

pkgs/by-name/hc/hcl2json/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hcl2json";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "tmccombs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aYsE4Tmi2h+XiLZH0faoB17UA7xHht8bec5Kud+NLIk=";
+    sha256 = "sha256-LU74vm36NuA1ApJWtEf/ub3los6yVR8yiQTfM0Wnvyo=";
   };
 
-  vendorHash = "sha256-Rjpru0SfGm9hdMQwvk8yM/E65YFB0NicaJ7a56/uwLE=";
+  vendorHash = "sha256-nm+KvpcOUTR9Nm0eQtqCWxMiFTvL5xKLhsPaJlsVpkQ=";
 
   subPackages = [ "." ];
 

pkgs/by-name/hd/hdf4/darwin-aarch64.patch

@@ -1,11 +0,0 @@
---- a/hdf/src/hdfi.h	2021-06-16 16:31:31.000000000 +1200
-+++ b/hdf/src/hdfi.h	2021-06-16 16:42:26.000000000 +1200
-@@ -1343,7 +1343,7 @@
- #endif /* IA64 */
- 
- /* Linux AArch64 */
--#if defined __aarch64__
-+#if defined __aarch64__ && !defined __APPLE__
- 
- #ifdef GOT_MACHINE
- If you get an error on this line more than one machine type has been defined.

pkgs/by-name/hd/hdf4/package.nix

@@ -20,38 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hdf";
-  version = "4.2.15";
+  version = "4.2.16-2";
 
   src = fetchurl {
     url = "https://support.hdfgroup.org/ftp/HDF/releases/HDF${finalAttrs.version}/src/hdf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-veA171oc1f29Cn8fpcF+mLvVmTABiaxNI08W6bt7yxI=";
+    hash = "sha256-xcMjS1ASJYrvLkQy9kmzHCGyYBWvuhhXrYNkDD8raSw=";
   };
 
-  patches = [
-    # Note that the PPC, SPARC and s390 patches are only needed so the aarch64 patch applies cleanly
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hdf/raw/edbe5f49646b609f5bc9aeeee5a2be47e9556e8c/f/hdf-ppc.patch";
-      hash = "sha256-AEsj88VzWtyZRk2nFWV/hLD/A2oPje38T/7jvfV1azU=";
-    })
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hdf/raw/edbe5f49646b609f5bc9aeeee5a2be47e9556e8c/f/hdf-4.2.4-sparc.patch";
-      hash = "sha256-EKuUQ1m+/HWTFYmkTormtQATDj0rHlQpI4CoK1m+5EY=";
-    })
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hdf/raw/edbe5f49646b609f5bc9aeeee5a2be47e9556e8c/f/hdf-s390.patch";
-      hash = "sha256-Ix6Ft+enNHADXFeRTDNijqU9XWmSEz/y8CnQoEleOCo=";
-    })
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hdf/raw/edbe5f49646b609f5bc9aeeee5a2be47e9556e8c/f/hdf-arm.patch";
-      hash = "sha256-gytMtvpvR1nzV1NncrYc0yz1ZlBku1AT6sPdubcK85Q=";
-    })
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hdf/raw/edbe5f49646b609f5bc9aeeee5a2be47e9556e8c/f/hdf-aarch64.patch";
-      hash = "sha256-eu+M3UbgI2plJNblAT8hO1xBXbfco6jX8iZMGjXbWoQ=";
-    })
-    ./darwin-aarch64.patch
-  ];
-
   nativeBuildInputs =
     [
       cmake

pkgs/by-name/im/imapdedup/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "imapdedup";
+  version = "1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "quentinsf";
+    repo = "IMAPdedup";
+    rev = "refs/tags/${version}";
+    hash = "sha256-s49nnMjX1beZKTrlcjzp0nESIVRb/LZDycpnzz8fG+o=";
+  };
+
+  build-system = with python3Packages; [ hatchling ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [ "imapdedup" ];
+
+  meta = {
+    description = "Duplicate email message remover";
+    homepage = "https://github.com/quentinsf/IMAPdedup";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    license = with lib.licenses; [ gpl2Only ];
+    mainProgram = "imapdedup";
+  };
+}

pkgs/by-name/in/inputplumber/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.39.2";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Glq7iJ1AHy99AGXYg5P3wAd3kAMJnt5P2vZzyn7qBY4=";
+    hash = "sha256-qo22x+eTqUUJ8Qnjv91QgBTy2SHFYv8JxPaGSnpIN9M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pcbW/Od5f+hFCrVpH2yioq+qCmlZ1m3TbUc6rBkYCEs=";
+  cargoHash = "sha256-atGFfl20FrEDVAO422fGsP6+ONLcH5XXOAWD/aWUup4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/in/intentrace/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.2.6";
+  version = "0.4.1";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage {
     owner = "sectordistrict";
     repo = "intentrace";
     rev = "refs/tags/v${version}";
-    hash = "sha256-e47hauVg5Ncp0C5y6RkfKfxMHbBvpKrVoUq3aJxTf2E=";
+    hash = "sha256-9BlCDtWnBDJuo6ovDi347jAQSOG8LizJAyQ/xN+HJ0w=";
   };
 
-  cargoHash = "sha256-MAbOEJdMkt6efTGdmimMpYAx39JnQlnOlbIHIGICgp8=";
+  cargoHash = "sha256-eJlAQpkI+RgfpDJGP9evWH28nU891PF4jeRpf2Os4Ts=";
 
   meta = {
     description = "Prettified Linux syscall tracing tool (like strace)";

pkgs/by-name/ip/ipopt/package.nix

@@ -19,13 +19,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.16";
+  version = "3.14.17";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-ZuiZZMq7NzOm6CCJgMBgEWs8PEfM3pVr2yOWbS42l8U=";
+    sha256 = "sha256-0IRHryADQArhhtfbQjCy+EDvVRi/ywc51IwiQOfWlR4=";
   };
 
   CXXDEFS = [

pkgs/by-name/ja/jamulus/package.nix

@@ -0,0 +1,45 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pkg-config,
+  libsForQt5,
+  libjack2,
+}:
+stdenv.mkDerivation rec {
+  pname = "jamulus";
+  version = "3.11.0";
+
+  src = fetchFromGitHub {
+    owner = "jamulussoftware";
+    repo = "jamulus";
+    tag = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-YxXSSVm3n96YzE51cXpWf4z2nQBSguvcEp/kU0a6iBA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsForQt5.qtscript
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
+    libsForQt5.qtdeclarative
+    libjack2
+  ];
+
+  qmakeFlags = [ "CONFIG+=noupcasename" ];
+
+  meta = {
+    description = "Enables musicians to perform real-time jam sessions over the internet";
+    longDescription = "You also need to enable JACK and should enable several real-time optimizations. See project website for details";
+    homepage = "https://github.com/corrados/jamulus";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "jamulus";
+    maintainers = with lib.maintainers; [ seb314 ];
+  };
+}

pkgs/by-name/ka/kanboard/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kanboard";
-  version = "1.2.42";
+  version = "1.2.43";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-/Unxl9Vh9pEWjO89sSviGGPFzUwxdb1mbOfpTFTyRL0=";
+    hash = "sha256-/PFE5h4elHFNbbIssoGMDkhGkEIec2uEMz+vU+DN5D0=";
   };
 
   dontBuild = true;

pkgs/by-name/ka/kanidm/1_4.nix

@@ -1,5 +1,5 @@
 import ./generic.nix {
-  version = "1.4.4";
-  hash = "sha256-AXgq9ohnSeQvq1IIhxMhe+FhX6/hyvRsJCI4VaiN/MQ=";
-  cargoHash = "sha256-/PsQ9yqyhSub1Qg2A3wOsgucq4rM0CU4uA8tEOJhtAU=";
+  version = "1.4.5";
+  hash = "sha256-0nn/ZyjkLXWXBZasNhbeEynEN52cmZQAcgg3hLmRpdo=";
+  cargoHash = "sha256-sLz1EdczSj0/ACLUpWex3i8ZUhNeyU/RVwuAqccLIz8=";
 }

pkgs/by-name/km/kmscube/package.nix

@@ -7,7 +7,7 @@
   libdrm,
   libX11,
   libGL,
-  mesa,
+  libgbm,
   pkg-config,
   gst_all_1,
 }:
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
       libdrm
       libX11
       libGL
-      mesa
+      libgbm
     ]
     ++ (with gst_all_1; [
       gstreamer

pkgs/by-name/li/librewolf-bin/package.nix

@@ -6,11 +6,11 @@
 
 let
   pname = "librewolf-bin";
-  upstreamVersion = "131.0.2-1";
+  upstreamVersion = "133.0.3-1";
   version = lib.replaceStrings [ "-" ] [ "." ] upstreamVersion;
   src = fetchurl {
     url = "https://gitlab.com/api/v4/projects/24386000/packages/generic/librewolf/${upstreamVersion}/LibreWolf.x86_64.AppImage";
-    hash = "sha256-Sj3WkY3t8UHsh2v3xPaDb0IGp66YQIw9MKmmFFQCGvk=";
+    hash = "sha256-mQR1hvMcAiNI8Xhwqfy6oysJ29Dbu12RPZg8xN4zPyw=";
   };
   appimageContents = appimageTools.extract { inherit pname version src; };
 in
@@ -27,7 +27,7 @@ appimageTools.wrapType2 {
     description = "Fork of Firefox, focused on privacy, security and freedom (upstream AppImage release)";
     homepage = "https://librewolf.net";
     license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ dwrege ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "librewolf";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/by-name/li/linuxwave/deps.nix

@@ -0,0 +1,13 @@
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
+{ linkFarm, fetchzip }:
+
+linkFarm "zig-packages" [
+  {
+    name = "122062d301a203d003547b414237229b09a7980095061697349f8bef41be9c30266b";
+    path = fetchzip {
+      url = "https://github.com/Hejsil/zig-clap/archive/refs/tags/0.9.1.tar.gz";
+      hash = "sha256-pscDsE1jJK1Nktq7rv/ScvsDqvvklFvtiGqOFf2eWvY=";
+    };
+  }
+]

pkgs/by-name/li/linuxwave/package.nix

@@ -3,26 +3,37 @@
   stdenv,
   fetchFromGitHub,
   installShellFiles,
-  zig_0_10,
+  zig_0_13,
+  apple-sdk_11,
+  callPackage,
 }:
 
+let
+  zig = zig_0_13;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linuxwave";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "linuxwave";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-5c8h9bAe3Qv7PJ3PPcwMJYKPlWsmnqshe6vLIgtdDiQ=";
+    hash = "sha256-mPBtffqd0+B7J8FxolzOarCyJIZBWkWPBbqZlhX0VSY=";
   };
 
+  postPatch = ''
+    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
+  '';
+
   nativeBuildInputs = [
     installShellFiles
-    zig_0_10.hook
+    zig.hook
   ];
 
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ];
+
   postInstall = ''
     installManPage man/linuxwave.1
   '';
@@ -33,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/orhun/linuxwave/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ figsoda ];
-    inherit (zig_0_10.meta) platforms;
+    inherit (zig.meta) platforms;
     mainProgram = "linuxwave";
   };
 })

pkgs/by-name/ma/mangayomi/package.nix

@@ -27,7 +27,7 @@
   libpulseaudio,
   libcaca,
   libdrm,
-  mesa,
+  libgbm,
   libXScrnSaver,
   nv-codec-headers-11,
   libXpresent,
@@ -125,7 +125,7 @@ flutter324.buildFlutterApplication {
     libpulseaudio
     libcaca
     libdrm
-    mesa
+    libgbm
     libXScrnSaver
     libXpresent
     nv-codec-headers-11

pkgs/by-name/ma/mautrix-whatsapp/package.nix

@@ -13,19 +13,19 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-yl/vDshjbJqGj6Kwhl6VnosbyrDCwt/0f3kHaxjYJmU=";
+    hash = "sha256-3S4aNoxK99iExhTJQP/JNq0GajCUjbdq4cUgCBudyXI=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-Uv4xoyBmmC3pCiJv5bhof73y30e52mdqfUZ5GORjMUM=";
+  vendorHash = "sha256-9iX+pzken+/7+nqYa71rcc1olCdpmu3UfR09ag3KSKs=";
 
   doCheck = false;
 

pkgs/by-name/me/meteor-git/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "meteor-git";
-  version = "0.24.2";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "stefanlogue";
     repo = "meteor";
     rev = "v${version}";
-    hash = "sha256-VuP7W20Mtml6K41PxQ8fPBeXLNvnvlMT8+rL5RIYi+A=";
+    hash = "sha256-2VeCbxHQNV2gNsRs7JVdSRmKI1pYZzW+amybrSRcjGY=";
   };
 
   vendorHash = "sha256-jKd/eJwp5SZvTrP3RN7xT7ibAB0PQondGR3RT+HQXIo=";

pkgs/by-name/mi/mieru/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "mieru";
-  version = "3.7.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "enfein";
     repo = "mieru";
     rev = "v${version}";
-    hash = "sha256-VFQWiihwd0YiLpgTxKUjVd+IkGivsa4jI/jb5ckjFt8=";
+    hash = "sha256-59TWABRIH3FEOyLvZ+jn7b3jhI0comjU4Mrl4Ggx2eA=";
   };
 
-  vendorHash = "sha256-woQoqYjdv2TZo66IwNkSHzIHFlu9JH8q/RXGyLlnTTc=";
+  vendorHash = "sha256-hSTKhn39xKZx1N9x66EH/ql4oP4qn0eysGTbUk9mRAk=";
   proxyVendor = true;
 
   ldflags = [

pkgs/by-name/mi/miniflux/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     rev = "refs/tags/${version}";
-    hash = "sha256-B/joQJ64/NPiZo1JEAhcrHLQ67m1oVTbmBk3drZ8lC4=";
+    hash = "sha256-h5bOZPaYu5DlN4trwf+iMafzfcyXemNdssTYpM6NCZY=";
   };
 
-  vendorHash = "sha256-hzgfuwewJDIz/iaBU3lyB2/mAxYGTWsKkaqAiCkPQQ0=";
+  vendorHash = "sha256-UR1nxza+rZtiSpY5hwAdCU4yiLm8weOCkrZHTqXQEpQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/mj/mjolnir/001-disable-nsfwprotection.patch

@@ -1,9 +1,9 @@
 diff --git a/src/protections/NsfwProtection.ts b/src/protections/NsfwProtection.ts
 deleted file mode 100644
-index 8b6f8fd..0000000
+index a6f45b2..0000000
 --- a/src/protections/NsfwProtection.ts
 +++ /dev/null
-@@ -1,99 +0,0 @@
+@@ -1,115 +0,0 @@
 -/*
 -Copyright 2024 The Matrix.org Foundation C.I.C.
 -
@@ -22,10 +22,9 @@ index 8b6f8fd..0000000
 -
 -import { Protection } from "./IProtection";
 -import { Mjolnir } from "../Mjolnir";
--import * as nsfw from 'nsfwjs';
--import {LogLevel} from "@vector-im/matrix-bot-sdk";
--import { node } from '@tensorflow/tfjs-node';
--
+-import * as nsfw from "nsfwjs";
+-import { LogLevel, LogService } from "@vector-im/matrix-bot-sdk";
+-import { node } from "@tensorflow/tfjs-node";
 -
 -export class NsfwProtection extends Protection {
 -    settings = {};
@@ -41,37 +40,50 @@ index 8b6f8fd..0000000
 -    }
 -
 -    public get name(): string {
--        return 'NsfwProtection';
+-        return "NsfwProtection";
 -    }
 -
 -    public get description(): string {
--        return "Scans all images sent into a protected room to determine if the image is " +
--            "NSFW. If it is, the image will automatically be redacted.";
+-        return (
+-            "Scans all images sent into a protected room to determine if the image is " +
+-            "NSFW. If it is, the image will automatically be redacted."
+-        );
 -    }
 -
 -    public async handleEvent(mjolnir: Mjolnir, roomId: string, event: any): Promise<any> {
--        if (event['type'] === 'm.room.message') {
--            let content = JSON.stringify(event['content']);
+-        if (event["type"] === "m.room.message") {
+-            let content = JSON.stringify(event["content"]);
 -            if (!content.toLowerCase().includes("mxc")) {
 -                return;
--             }
+-            }
 -            // try and grab a human-readable alias for more helpful management room output
--            const maybeAlias = await mjolnir.client.getPublishedAlias(roomId)
--            const room = maybeAlias ? maybeAlias : roomId
+-            const maybeAlias = await mjolnir.client.getPublishedAlias(roomId);
+-            const room = maybeAlias ? maybeAlias : roomId;
 -
 -            const mxcs = content.match(/(mxc?:\/\/[^\s'"]+)/gim);
 -            if (!mxcs) {
 -                //something's gone wrong with the regex
--                await mjolnir.managementRoomOutput.logMessage(LogLevel.ERROR, "NSFWProtection", `Unable to find any mxcs in  ${event["event_id"]} in ${room}`);
+-                await mjolnir.managementRoomOutput.logMessage(
+-                    LogLevel.ERROR,
+-                    "NSFWProtection",
+-                    `Unable to find any mxcs in  ${event["event_id"]} in ${room}`,
+-                );
 -                return;
 -            }
 -
 -            // @ts-ignore - see null check immediately above
 -            for (const mxc of mxcs) {
 -                const image = await mjolnir.client.downloadContent(mxc);
--                const decodedImage = await node.decodeImage(image.data, 3);
--                const predictions = await this.model.classify(decodedImage);
 -
+-                let decodedImage;
+-                try {
+-                    decodedImage = await node.decodeImage(image.data, 3);
+-                } catch (e) {
+-                    LogService.error("NsfwProtection", `There was an error processing an image: ${e}`);
+-                    continue;
+-                }
+-
+-                const predictions = await this.model.classify(decodedImage);
 -
 -                for (const prediction of predictions) {
 -                    if (["Hentai", "Porn"].includes(prediction["className"])) {
@@ -79,22 +91,26 @@ index 8b6f8fd..0000000
 -                            try {
 -                                await mjolnir.client.redactEvent(roomId, event["event_id"]);
 -                            } catch (err) {
--                                await mjolnir.managementRoomOutput.logMessage(LogLevel.ERROR, "NSFWProtection", `There was an error redacting ${event["event_id"]} in ${room}: ${err}`);
+-                                await mjolnir.managementRoomOutput.logMessage(
+-                                    LogLevel.ERROR,
+-                                    "NSFWProtection",
+-                                    `There was an error redacting ${event["event_id"]} in ${room}: ${err}`,
+-                                );
 -                            }
--                            let eventId = event["event_id"]
--                            let body = `Redacted an image in ${room} ${eventId}`
+-                            let eventId = event["event_id"];
+-                            let body = `Redacted an image in ${room} ${eventId}`;
 -                            let formatted_body = `<details>
 -                                                  <summary>Redacted an image in ${room}</summary>
--                                                  <pre>${eventId}</pre>  <pre></pre>${room}</pre>
--                                                  </details>`
+-                                                  <pre>${eventId}</pre>  <pre>${room}</pre>
+-                                                  </details>`;
 -                            const msg = {
 -                                msgtype: "m.notice",
 -                                body: body,
 -                                format: "org.matrix.custom.html",
--                                formatted_body: formatted_body
+-                                formatted_body: formatted_body,
 -                            };
 -                            await mjolnir.client.sendMessage(mjolnir.managementRoomId, msg);
--                            break
+-                            break;
 -                        }
 -                    }
 -                }
@@ -103,16 +119,15 @@ index 8b6f8fd..0000000
 -        }
 -    }
 -}
-\ No newline at end of file
 diff --git a/src/protections/ProtectionManager.ts b/src/protections/ProtectionManager.ts
-index 9b84318..67f10dc 100644
+index 485f05e..6ffb0d1 100644
 --- a/src/protections/ProtectionManager.ts
 +++ b/src/protections/ProtectionManager.ts
 @@ -31,7 +31,6 @@ import { htmlEscape } from "../utils";
  import { ERROR_KIND_FATAL, ERROR_KIND_PERMISSION } from "../ErrorCache";
  import { RoomUpdateError } from "../models/RoomUpdateError";
  import { LocalAbuseReports } from "./LocalAbuseReports";
--import {NsfwProtection} from "./NsfwProtection";
+-import { NsfwProtection } from "./NsfwProtection";
  import { MentionSpam } from "./MentionSpam";
  
  const PROTECTIONS: Protection[] = [
@@ -121,10 +136,10 @@ index 9b84318..67f10dc 100644
      new JoinWaveShortCircuit(),
      new LocalAbuseReports(),
 -    new NsfwProtection(),
-     new MentionSpam()
+     new MentionSpam(),
  ];
  
-@@ -104,9 +102,6 @@ export class ProtectionManager {
+@@ -106,9 +104,6 @@ export class ProtectionManager {
              protection.settings[key].setValue(value);
          }
          if (protection.enabled) {
@@ -136,49 +151,54 @@ index 9b84318..67f10dc 100644
              }
 diff --git a/test/integration/nsfwProtectionTest.ts b/test/integration/nsfwProtectionTest.ts
 deleted file mode 100644
-index c86fd38..0000000
+index ed215e0..0000000
 --- a/test/integration/nsfwProtectionTest.ts
 +++ /dev/null
-@@ -1,78 +0,0 @@
--import {newTestUser} from "./clientHelper";
+@@ -1,89 +0,0 @@
+-import { newTestUser } from "./clientHelper";
 -
--import {MatrixClient} from "@vector-im/matrix-bot-sdk";
--import {getFirstReaction} from "./commands/commandUtils";
--import {strict as assert} from "assert";
--import { readFileSync } from 'fs';
+-import { MatrixClient } from "@vector-im/matrix-bot-sdk";
+-import { getFirstReaction } from "./commands/commandUtils";
+-import { strict as assert } from "assert";
+-import { readFileSync } from "fs";
 -
 -describe("Test: NSFW protection", function () {
 -    let client: MatrixClient;
 -    let room: string;
 -    this.beforeEach(async function () {
--        client = await newTestUser(this.config.homeserverUrl, {name: {contains: "nsfw-protection"}});
+-        client = await newTestUser(this.config.homeserverUrl, { name: { contains: "nsfw-protection" } });
 -        await client.start();
 -        const mjolnirId = await this.mjolnir.client.getUserId();
 -        room = await client.createRoom({ invite: [mjolnirId] });
 -        await client.joinRoom(room);
 -        await client.joinRoom(this.config.managementRoom);
 -        await client.setUserPowerLevel(mjolnirId, room, 100);
--    })
+-    });
 -    this.afterEach(async function () {
 -        await client.stop();
--    })
+-    });
 -
 -    function delay(ms: number) {
--        return new Promise(resolve => setTimeout(resolve, ms));
+-        return new Promise((resolve) => setTimeout(resolve, ms));
 -    }
 -
--
--    it("Nsfw protection doesn't redact sfw images", async function() {
+-    it("Nsfw protection doesn't redact sfw images", async function () {
 -        this.timeout(20000);
 -
--        await client.sendMessage(this.mjolnir.managementRoomId, { msgtype: 'm.text', body: `!mjolnir rooms add ${room}` });
--        await getFirstReaction(client, this.mjolnir.managementRoomId, '✅', async () => {
--                return await client.sendMessage(this.mjolnir.managementRoomId, { msgtype: 'm.text', body: `!mjolnir enable NsfwProtection` });
+-        await client.sendMessage(this.mjolnir.managementRoomId, {
+-            msgtype: "m.text",
+-            body: `!mjolnir rooms add ${room}`,
+-        });
+-        await getFirstReaction(client, this.mjolnir.managementRoomId, "✅", async () => {
+-            return await client.sendMessage(this.mjolnir.managementRoomId, {
+-                msgtype: "m.text",
+-                body: `!mjolnir enable NsfwProtection`,
+-            });
 -        });
 -
--        const data = readFileSync('test_tree.jpg');
--        const mxc = await client.uploadContent(data, 'image/png');
--        let content = {"msgtype": "m.image", "body": "test.jpeg", "url": mxc};
+-        const data = readFileSync("test_tree.jpg");
+-        const mxc = await client.uploadContent(data, "image/png");
+-        let content = { msgtype: "m.image", body: "test.jpeg", url: mxc };
 -        let imageMessage = await client.sendMessage(room, content);
 -
 -        await delay(500);
@@ -186,36 +206,41 @@ index c86fd38..0000000
 -        assert.equal(Object.keys(processedImage.content).length, 3, "This event should not have been redacted");
 -    });
 -
--    it("Nsfw protection redacts nsfw images", async function() {
+-    it("Nsfw protection redacts nsfw images", async function () {
 -        this.timeout(20000);
 -        // dial the sensitivity on the protection way up so that all images are flagged as NSFW
 -        this.mjolnir.config.nsfwSensitivity = 0.0;
 -
--        await client.sendMessage(this.mjolnir.managementRoomId, { msgtype: 'm.text', body: `!mjolnir rooms add ${room}` });
--        await getFirstReaction(client, this.mjolnir.managementRoomId, '✅', async () => {
--                return await client.sendMessage(this.mjolnir.managementRoomId, { msgtype: 'm.text', body: `!mjolnir enable NsfwProtection` });
+-        await client.sendMessage(this.mjolnir.managementRoomId, {
+-            msgtype: "m.text",
+-            body: `!mjolnir rooms add ${room}`,
+-        });
+-        await getFirstReaction(client, this.mjolnir.managementRoomId, "✅", async () => {
+-            return await client.sendMessage(this.mjolnir.managementRoomId, {
+-                msgtype: "m.text",
+-                body: `!mjolnir enable NsfwProtection`,
+-            });
 -        });
 -
--        const data = readFileSync('test_tree.jpg');
--        const mxc = await client.uploadContent(data, 'image/png');
--        let content = {"msgtype": "m.image", "body": "test.jpeg", "url": mxc};
+-        const data = readFileSync("test_tree.jpg");
+-        const mxc = await client.uploadContent(data, "image/png");
+-        let content = { msgtype: "m.image", body: "test.jpeg", url: mxc };
 -        let imageMessage = await client.sendMessage(room, content);
 -
--        let formatted_body = `<img src=${mxc} />`
+-        let formatted_body = `<img src=${mxc} />`;
 -        let htmlContent = {
--                                msgtype: "m.image",
--                                body: formatted_body,
--                                format: "org.matrix.custom.html",
--                                formatted_body: formatted_body
--                            };
--        let htmlMessage = await client.sendMessage(room, htmlContent)
+-            msgtype: "m.image",
+-            body: formatted_body,
+-            format: "org.matrix.custom.html",
+-            formatted_body: formatted_body,
+-        };
+-        let htmlMessage = await client.sendMessage(room, htmlContent);
 -
 -        await delay(500);
 -        let processedImage = await client.getEvent(room, imageMessage);
 -        assert.equal(Object.keys(processedImage.content).length, 0, "This event should have been redacted");
 -
--        let processedHtml = await client.getEvent(room, htmlMessage)
--        assert.equal(Object.keys(processedHtml.content).length, 0, "This html image event should have been redacted")
+-        let processedHtml = await client.getEvent(room, htmlMessage);
+-        assert.equal(Object.keys(processedHtml.content).length, 0, "This html image event should have been redacted");
 -    });
 -});
-\ No newline at end of file

pkgs/by-name/mj/mjolnir/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir",
-  "version": "1.8.3",
+  "version": "1.9.1",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "git@github.com:matrix-org/mjolnir.git",
@@ -10,7 +10,7 @@
   "scripts": {
     "build": "tsc",
     "postbuild": "rm -rf lib/test/ && cp -r lib/src/* lib/ && rm -rf lib/src/",
-    "lint": "tslint --project ./tsconfig.json -t stylish",
+    "lint": "tslint --project ./tsconfig.json -t stylish && npx prettier . --check",
     "start:dev": "yarn build && node --async-stack-traces lib/index.js",
     "test": "ts-mocha --project ./tsconfig.json test/commands/**/*.ts",
     "test:integration": "NODE_ENV=harness ts-mocha --async-stack-traces --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json \"test/integration/**/*Test.ts\"",
@@ -58,6 +58,7 @@
     "humanize-duration-ts": "^2.1.1",
     "js-yaml": "^4.1.0",
     "jsdom": "^16.6.0",
+    "lru-cache": "^11.0.1",
     "matrix-appservice-bridge": "10.3.1",
     "nsfwjs": "^4.1.0",
     "parse-duration": "^1.0.2",
@@ -69,5 +70,6 @@
   },
   "engines": {
     "node": ">=20.0.0"
-  }
+  },
+  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }