Merge remote-tracking branch 'origin/staging-next' into staging

ci/eval/compare/default.nix

@@ -9,6 +9,7 @@
   beforeResultDir,
   afterResultDir,
   touchedFilesJson,
+  byName ? false,
 }:
 let
   /*
@@ -119,6 +120,7 @@ let
   maintainers = import ./maintainers.nix {
     changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
     changedpathsjson = touchedFilesJson;
+    inherit byName;
   };
 in
 runCommand "compare"

ci/eval/compare/maintainers.nix

@@ -1,5 +1,9 @@
 # Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
-{ changedattrs, changedpathsjson }:
+{
+  changedattrs,
+  changedpathsjson,
+  byName ? false,
+}:
 let
   pkgs = import ../../.. {
     system = "x86_64-linux";
@@ -41,7 +45,18 @@ let
   ) validPackageAttributes;
 
   attrsWithMaintainers = builtins.map (
-    pkg: pkg // { maintainers = (pkg.package.meta or { }).maintainers or [ ]; }
+    pkg:
+    let
+      meta = pkg.package.meta or { };
+    in
+    pkg
+    // {
+      # TODO: Refactor this so we can ping entire teams instead of the individual members.
+      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+      maintainers =
+        meta.maintainers or [ ]
+        ++ lib.flatten (map (team: team.members or [ ]) (meta.teams or [ ]));
+    }
   ) attrsWithPackages;
 
   relevantFilenames =
@@ -83,12 +98,13 @@ let
     pkg:
     builtins.map (maintainer: {
       id = maintainer.githubId;
+      inherit (maintainer) github;
       packageName = pkg.name;
       dueToFiles = pkg.filenames;
     }) pkg.maintainers
   ) attrsWithModifiedFiles;
 
-  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
+  byMaintainer = lib.groupBy (ping: toString ping.${if byName then "github" else "id"}) listToPing;
 
   packagesPerMaintainer = lib.attrsets.mapAttrs (
     maintainer: packages: builtins.map (pkg: pkg.packageName) packages

doc/build-helpers/images/appimagetools.section.md

@@ -33,7 +33,7 @@ let
   version = "0.6.30";
 
   src = fetchurl {
-    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
 in

doc/doc-support/package.nix

@@ -49,6 +49,8 @@ stdenvNoCC.mkDerivation (
     '';
 
     buildPhase = ''
+      runHook preBuild
+
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
@@ -84,9 +86,13 @@ stdenvNoCC.mkDerivation (
         --section-toc-depth 1 \
         manual.md \
         out/index.html
+
+      runHook postBuild
     '';
 
     installPhase = ''
+      runHook preInstall
+
       dest="$out/share/doc/nixpkgs"
       mkdir -p "$(dirname "$dest")"
       mv out "$dest"
@@ -97,6 +103,8 @@ stdenvNoCC.mkDerivation (
       mkdir -p $out/nix-support/
       echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
       echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
+
+      runHook postInstall
     '';
 
     passthru = {

doc/functions/generators.section.md

@@ -27,8 +27,8 @@ let
     } ":";
   };
 
-  # the INI file can now be given as plain old nix values
 in
+# the INI file can now be given as plain old nix values
 customToINI {
   main = {
     pushinfo = true;

doc/hooks/tauri.section.md

@@ -23,15 +23,15 @@ In Nixpkgs, `cargo-tauri.hook` overrides the default build and install phases.
   wrapGAppsHook4,
 }:
 
-rustPlatform.buildRustPackage rec {
-  # . . .
+rustPlatform.buildRustPackage (finalAttrs: {
+  # ...
 
   useFetchCargoVendor = true;
   cargoHash = "...";
 
   # Assuming our app's frontend uses `npm` as a package manager
   npmDeps = fetchNpmDeps {
-    name = "${pname}-npm-deps-${version}";
+    name = "${finalAttrs.pname}-npm-deps-${finalAttrs.version}";
     inherit src;
     hash = "...";
   };
@@ -61,8 +61,8 @@ rustPlatform.buildRustPackage rec {
   # And make sure we build there too
   buildAndTestSubdir = cargoRoot;
 
-  # . . .
-}
+  # ...
+})
 ```
 
 ## Variables controlling cargo-tauri {#tauri-hook-variables-controlling}

doc/languages-frameworks/agda.section.md

@@ -208,8 +208,12 @@ mkDerivation {
   libraryName = "IAL-1.3";
 
   buildPhase = ''
+    runHook preBuild
+
     patchShebangs find-deps.sh
     make
+
+    runHook postBuild
   '';
 }
 ```

doc/languages-frameworks/bower.section.md

@@ -105,10 +105,17 @@ pkgs.stdenv.mkDerivation {
     src = myWebApp;
   };
 
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook # note 3
+  ];
+
   buildPhase = ''
+    runHook preBuild
+
     cp --reflink=auto --no-preserve=mode -R $bowerComponents/bower_components . # note 2
-    export HOME=$PWD # note 3
     ${pkgs.nodePackages.gulp}/bin/gulp build # note 4
+
+    runHook postBuild
   '';
 
   installPhase = "mv gulpdist $out";

doc/languages-frameworks/dart.section.md

@@ -42,8 +42,8 @@ buildDartApplication rec {
 
   src = fetchFromGitHub {
     owner = "sass";
-    repo = pname;
-    rev = version;
+    repo = "dart-sass";
+    tag = version;
     hash = "sha256-U6enz8yJcc4Wf8m54eYIAnVg/jsGi247Wy8lp1r1wg4=";
   };
 

doc/languages-frameworks/dlang.section.md

@@ -22,7 +22,7 @@ buildDubPackage rec {
   src = fetchFromGitHub {
     owner = "CyberShadow";
     repo = "btdu";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3sSZq+5UJH02IO0Y1yL3BLHDb4lk8k6awb5ZysBQciE=";
   };
 

doc/languages-frameworks/emscripten.section.md

@@ -41,12 +41,13 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 (pkgs.zlib.override {
   stdenv = pkgs.emscriptenStdenv;
 }).overrideAttrs
-  (old: rec {
+  (old: {
     buildInputs = old.buildInputs ++ [ pkg-config ];
     # we need to reset this setting!
     env = (old.env or { }) // {
       NIX_CFLAGS_COMPILE = "";
     };
+
     configurePhase = ''
       # FIXME: Some tests require writing at $HOME
       HOME=$TMPDIR
@@ -57,15 +58,29 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 
       runHook postConfigure
     '';
+
     dontStrip = true;
     outputs = [ "out" ];
+
     buildPhase = ''
+      runHook preBuild
+
       emmake make
+
+      runHook postBuild
     '';
+
     installPhase = ''
+      runHook preInstall
+
       emmake make install
+
+      runHook postInstall
     '';
+
     checkPhase = ''
+      runHook preCheck
+
       echo "================= testing zlib using node ================="
 
       echo "Compiling a custom test"
@@ -84,6 +99,8 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
         echo "it seems to work! very good."
       fi
       echo "================= /testing zlib using node ================="
+
+      runHook postCheck
     '';
 
     postPatch = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin ''
@@ -102,8 +119,9 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
 This `xmlmirror` example features an Emscripten package that is defined completely from this context and no `pkgs.zlib.override` is used.
 
 ```nix
-pkgs.buildEmscriptenPackage rec {
-  name = "xmlmirror";
+pkgs.buildEmscriptenPackage {
+  pname = "xmlmirror";
+  version = "1.2.3";
 
   buildInputs = [
     pkg-config
@@ -116,8 +134,10 @@ pkgs.buildEmscriptenPackage rec {
     openjdk
     json_c
   ];
+
   nativeBuildInputs = [
     pkg-config
+    writableTmpDirAsHomeHook
     zlib
   ];
 
@@ -128,6 +148,8 @@ pkgs.buildEmscriptenPackage rec {
   };
 
   configurePhase = ''
+    runHook preConfigure
+
     rm -f fastXmlLint.js*
     # a fix for ERROR:root:For asm.js, TOTAL_MEMORY must be a multiple of 16MB, was 234217728
     # https://gitlab.com/odfplugfest/xmlmirror/issues/8
@@ -137,11 +159,16 @@ pkgs.buildEmscriptenPackage rec {
     sed -e "s/\$(JSONC_LDFLAGS) \$(ZLIB_LDFLAGS) \$(LIBXML20_LDFLAGS)/\$(JSONC_LDFLAGS) \$(LIBXML20_LDFLAGS) \$(ZLIB_LDFLAGS) /g" -i Makefile.emEnv
     # https://gitlab.com/odfplugfest/xmlmirror/issues/11
     sed -e "s/-o fastXmlLint.js/-s EXTRA_EXPORTED_RUNTIME_METHODS='[\"ccall\", \"cwrap\"]' -o fastXmlLint.js/g" -i Makefile.emEnv
+
+    runHook postConfigure
   '';
 
   buildPhase = ''
-    HOME=$TMPDIR
+    runHook preBuild
+
     make -f Makefile.emEnv
+
+    runHook postBuild
   '';
 
   outputs = [
@@ -150,6 +177,8 @@ pkgs.buildEmscriptenPackage rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share
     mkdir -p $doc/share/${name}
 
@@ -163,9 +192,13 @@ pkgs.buildEmscriptenPackage rec {
     cp *.json $out/share
     cp *.rng $out/share
     cp README.md $doc/share/${name}
+    runHook postInstall
   '';
-  checkPhase = ''
 
+  checkPhase = ''
+    runHook preCheck
+
+    runHook postCheck
   '';
 }
 ```

doc/languages-frameworks/go.section.md

@@ -13,14 +13,14 @@ The following is an example expression using `buildGoModule`:
 
 ```nix
 {
-  pet = buildGoModule rec {
+  pet = buildGoModule (finalAttrs: {
     pname = "pet";
     version = "0.3.4";
 
     src = fetchFromGitHub {
       owner = "knqyf263";
       repo = "pet";
-      rev = "v${version}";
+      tag = "v${finalAttrs.version}";
       hash = "sha256-Gjw1dRrgM8D3G7v6WIM2+50r4HmTXvx0Xxme2fH9TlQ=";
     };
 
@@ -32,7 +32,7 @@ The following is an example expression using `buildGoModule`:
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [ kalbasit ];
     };
-  };
+  });
 }
 ```
 

doc/languages-frameworks/javascript.section.md

@@ -198,14 +198,14 @@ Here's an example:
   fetchFromGitHub,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "flood";
   version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "jesec";
-    repo = pname;
-    rev = "v${version}";
+    repo = "flood";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BR+ZGkBBfd0dSQqAvujsbgsEPFYw/ThrylxUbOksYxM=";
   };
 
@@ -222,7 +222,7 @@ buildNpmPackage rec {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ winter ];
   };
-}
+})
 ```
 
 In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
@@ -646,9 +646,16 @@ It's important to use the `--offline` flag. For example if you script is `"build
 
 ```nix
 {
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
   buildPhase = ''
-    export HOME=$(mktemp -d)
+    runHook preBuild
+
     yarn --offline build
+
+    runHook postBuild
   '';
 }
 ```

doc/languages-frameworks/lisp.section.md

@@ -135,7 +135,6 @@ During Quicklisp import:
 - names starting with a number have a `_` prepended (`3d-vectors`->`_3d-vectors`)
 - `_` in names is converted to `__` for reversibility
 
-
 ## Defining packages manually inside Nixpkgs {#lisp-defining-packages-inside}
 
 Packages that for some reason are not in Quicklisp, and so cannot be
@@ -185,7 +184,7 @@ let
       domain = "gitlab.common-lisp.net";
       owner = "alexandria";
       repo = "alexandria";
-      rev = "v${version}";
+      tag = "v${version}";
       hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
     };
   };
@@ -212,7 +211,7 @@ sbcl.pkgs.alexandria.overrideLispAttrs (oldAttrs: rec {
     domain = "gitlab.common-lisp.net";
     owner = "alexandria";
     repo = "alexandria";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-1Hzxt65dZvgOFIljjjlSGgKYkj+YBLwJCACi5DZsKmQ=";
   };
 })

doc/languages-frameworks/maven.section.md

@@ -23,8 +23,8 @@ maven.buildMavenPackage rec {
 
   src = fetchFromGitHub {
     owner = "intoolswetrust";
-    repo = pname;
-    rev = "${pname}-${version}";
+    repo = "jd-cli";
+    tag = "jd-cli-${version}";
     hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";
   };
 
@@ -33,11 +33,15 @@ maven.buildMavenPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/share/jd-cli
     install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
 
     makeWrapper ${jre}/bin/java $out/bin/jd-cli \
       --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
+
+    runHook postInstall
   '';
 
   meta = {
@@ -301,16 +305,24 @@ stdenv.mkDerivation {
   buildInputs = [ maven ];
   src = ./.; # or fetchFromGitHub, cleanSourceWith, etc
   buildPhase = ''
+    runHook preBuild
+
     mvn package -Dmaven.repo.local=$out
+
+    runHook postBuild
   '';
 
   # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
   installPhase = ''
+    runHook preInstall
+
     find $out -type f \
       -name \*.lastUpdated -or \
       -name resolver-status.properties -or \
       -name _remote.repositories \
       -delete
+
+    runHook postInstall
   '';
 
   # don't do any fixup
@@ -354,11 +366,11 @@ Regardless of which strategy is chosen above, the step to build the derivation i
   maven,
   callPackage,
 }:
-# pick a repository derivation, here we will use buildMaven
 let
+  # pick a repository derivation, here we will use buildMaven
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -366,14 +378,22 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    runHook preInstall
+
+    install -Dm644 target/${finalAttrs.pname}-${finalAttrs.version}.jar $out/share/java
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 ::: {.tip}
@@ -421,7 +441,7 @@ We make sure to provide this classpath to the `makeWrapper`.
 let
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -430,22 +450,30 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
 
     classpath=$(find ${repository} -name "*.jar" -printf ':%h/%f');
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/${pname} \
-          --add-flags "-classpath $out/share/java/${pname}-${version}.jar:''${classpath#:}" \
+    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+          --add-flags "-classpath $out/share/java/maven-demo-${finalAttrs.version}.jar:''${classpath#:}" \
           --add-flags "Main"
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 #### MANIFEST file via Maven Plugin {#manifest-file-via-maven-plugin}
@@ -502,11 +530,11 @@ We will modify the derivation above to add a symlink to our repository so that i
   makeWrapper,
   jre,
 }:
-# pick a repository derivation, here we will use buildMaven
 let
+  # pick a repository derivation, here we will use buildMaven
   repository = callPackage ./build-maven-repository.nix { };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "maven-demo";
   version = "1.0";
 
@@ -515,23 +543,31 @@ stdenv.mkDerivation rec {
   buildInputs = [ maven ];
 
   buildPhase = ''
+    runHook preBuild
+
     echo "Using repository ${repository}"
     mvn --offline -Dmaven.repo.local=${repository} package;
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
 
     # create a symbolic link for the repository directory
     ln -s ${repository} $out/repository
 
-    install -Dm644 target/${pname}-${version}.jar $out/share/java
+    install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/${pname} \
-          --add-flags "-jar $out/share/java/${pname}-${version}.jar"
+    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+          --add-flags "-jar $out/share/java/maven-demo-${finalAttrs.version}.jar"
+
+    runHook postInstall
   '';
-}
+})
 ```
 ::: {.note}
 Our script produces a dependency on `jre` rather than `jdk` to restrict the runtime closure necessary to run the application.

doc/languages-frameworks/ocaml.section.md

@@ -83,8 +83,8 @@ buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "inhabitedtype";
-    repo = pname;
-    rev = version;
+    repo = "angstrom";
+    tag = version;
     hash = "sha256-MK8o+iPGANEhrrTc1Kz9LBilx2bDPQt7Pp5P2libucI=";
   };
 
@@ -124,7 +124,7 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.02";
 
   src = fetchurl {
-    url = "https://github.com/flowtype/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    url = "https://github.com/flowtype/ocaml-wtf8/releases/download/v${version}/wtf8-v${version}.tbz";
     hash = "sha256-d5/3KUBAWRj8tntr4RkJ74KWW7wvn/B/m1nx0npnzyc=";
   };
 

doc/languages-frameworks/perl.section.md

@@ -39,7 +39,7 @@ Perl packages from CPAN are defined in [pkgs/top-level/perl-packages.nix](https:
     pname = "Class-C3";
     version = "0.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/F/FL/FLORA/${pname}-${version}.tar.gz";
+      url = "mirror://cpan/authors/id/F/FL/FLORA/Class-C3-${version}.tar.gz";
       hash = "sha256-/5GE5xHT0uYGOQxroqj6LMU7CtKn2s6vMVoSXxL4iK4=";
     };
   };
@@ -88,7 +88,7 @@ buildPerlPackage rec {
   version = "0.36";
 
   src = fetchurl {
-    url = "mirror://cpan/authors/id/P/PM/PMQS/${pname}-${version}.tar.gz";
+    url = "mirror://cpan/authors/id/P/PM/PMQS/BerkeleyDB-${version}.tar.gz";
     hash = "sha256-4Y+HGgGQqcOfdiKcFIyMrWBEccVNVAMDBWZlFTMorh8=";
   };
 
@@ -107,7 +107,7 @@ Dependencies on other Perl packages can be specified in the `buildInputs` and `p
     pname = "Class-C3-Componentised";
     version = "1.0004";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AS/ASH/${pname}-${version}.tar.gz";
+      url = "mirror://cpan/authors/id/A/AS/ASH/Class-C3-Componentised-${version}.tar.gz";
       hash = "sha256-ASO9rV/FzJYZ0BH572Fxm2ZrFLMZLFATJng1NuU4FHc=";
     };
     propagatedBuildInputs = [
@@ -137,7 +137,7 @@ On Darwin, if a script has too many `-Idir` flags in its first line (its “sheb
     version = "12.50";
 
     src = fetchurl {
-      url = "https://exiftool.org/${pname}-${version}.tar.gz";
+      url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
       hash = "sha256-vOhB/FwQMC8PPvdnjDvxRpU6jAZcC6GMQfc0AH4uwKg=";
     };
 

doc/languages-frameworks/python.section.md

@@ -2135,8 +2135,9 @@ Occasionally packages don't make use of a common test framework, which may then
 
 #### Common issues {#common-issues}
 
-* Tests that attempt to access `$HOME` can be fixed by using the following
-  work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+* Tests that attempt to access `$HOME` can be fixed by using `writableTmpDirAsHomeHook` in
+  `nativeCheckInputs`, which sets up a writable temporary directory as the home directory. Alternatively,
+  you can achieve the same effect manually (e.g. in `preCheck`) with: `export HOME=$(mktemp -d)`.
 * Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.
   This can be fixed with two changes in the derivation: 1) replacing `pytest` with
   `pytestCheckHook` and 2) adding a `preCheck` containing `cd $out` to run

doc/languages-frameworks/rust.section.md

@@ -28,14 +28,14 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ripgrep";
   version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
-    repo = pname;
-    rev = version;
+    repo = "ripgrep";
+    tag = finalAttrs.version;
     hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.unlicense;
     maintainers = [ ];
   };
-}
+})
 ```
 
 `buildRustPackage` requires a `cargoHash` attribute, computed over all crate sources of this package.
@@ -104,21 +104,21 @@ be made invariant to the version by setting `cargoDepsName` to
 `pname`:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "broot";
   version = "1.2.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-aDQA4A5mScX9or3Lyiv/5GyAehidnpKKE0grhbP1Ctc=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-iDYh52rj1M5Uupvbx2WeDd/jvQZ+2A50V5rp5e2t7q4=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   # ...
-}
+})
 ```
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
@@ -184,7 +184,7 @@ The output hash of each dependency that uses a git source must be
 specified in the `outputHashes` attribute. For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -209,7 +209,7 @@ For usage outside nixpkgs, `allowBuiltinFetchGit` could be used to
 avoid having to specify `outputHashes`. For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -235,7 +235,7 @@ If you want to use different features for check phase, you can use
 For example:
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "myproject";
   version = "1.0.0";
 
@@ -427,7 +427,7 @@ source code in a reproducible way. If it is missing or out-of-date one can use
 the `cargoPatches` attribute to update or add it.
 
 ```nix
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   # ...
   cargoPatches = [
     # a patch file to add/update Cargo.lock in the source code
@@ -575,8 +575,8 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "huggingface";
-    repo = pname;
-    rev = "python-v${version}";
+    repo = "tokenizers";
+    tag = "python-v${version}";
     hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
   };
 
@@ -665,7 +665,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "retworkx";
-    rev = version;
+    tag = version;
     hash = "sha256-11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20=";
   };
 
@@ -705,7 +705,7 @@ Some projects, especially GNOME applications, are built with the Meson Build Sys
   tinysparql,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "health";
   version = "0.95.0";
 
@@ -713,12 +713,12 @@ stdenv.mkDerivation rec {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "health";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-eR1ZGtTZQNhofFUEjI7IX16sMKPJmAl7aIFfPJukecg=";
   };
 
@@ -740,7 +740,7 @@ stdenv.mkDerivation rec {
   ];
 
   # ...
-}
+})
 ```
 
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
@@ -1000,20 +1000,21 @@ let
   };
 in
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ripgrep";
   version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-9atn5qyBDy4P6iUoHFhg+TV6Ur71fiah4oTJbBMeEy4=";
 
+  # Tests require network access. Skipping.
   doCheck = false;
 
   meta = {
@@ -1025,7 +1026,7 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [ ];
   };
-}
+})
 ```
 
 Follow the below steps to try that snippet.

doc/languages-frameworks/swift.section.md

@@ -82,15 +82,15 @@ let
   generated = swiftpm2nix.helpers ./nix;
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "myproject";
   version = "0.0.0";
 
   src = fetchFromGitHub {
     owner = "nixos";
-    repo = pname;
-    rev = version;
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    repo = "myproject";
+    tag = finalAttrs.version;
+    hash = "";
   };
 
   # Including SwiftPM as a nativeBuildInput provides a buildPhase for you.
@@ -106,14 +106,18 @@ stdenv.mkDerivation rec {
   configurePhase = generated.configure;
 
   installPhase = ''
+    runHook preInstall
+
     # This is a special function that invokes swiftpm to find the location
     # of the binaries it produced.
     binPath="$(swiftpmBinPath)"
     # Now perform any installation steps.
     mkdir -p $out/bin
     cp $binPath/myproject $out/bin/
+
+    runHook postInstall
   '';
-}
+})
 ```
 
 ### Custom build flags {#ssec-swiftpm-custom-build-flags}

doc/languages-frameworks/texlive.section.md

@@ -94,18 +94,18 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
 - TeX Live packages are also available under `texlive.pkgs` as derivations with outputs `out`, `tex`, `texdoc`, `texsource`, `tlpkg`, `man`, `info`. They cannot be installed outside of `texlive.combine` but are available for other uses. To repackage a font, for instance, use
 
   ```nix
-  stdenvNoCC.mkDerivation rec {
+  stdenvNoCC.mkDerivation (finalAttrs: {
     src = texlive.pkgs.iwona;
     dontUnpack = true;
 
-    inherit (src) pname version;
+    inherit (finalAttrs.src) pname version;
 
     installPhase = ''
       runHook preInstall
       install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
       runHook postInstall
     '';
-  }
+  })
   ```
 
   See `biber`, `iwona` for complete examples.
@@ -173,6 +173,7 @@ let
       (writeShellScript "force-tex-output.sh" ''
         out="''${tex-}"
       '')
+      writableTmpDirAsHomeHook # Need a writable $HOME for latexmk
     ];
 
     dontConfigure = true;
@@ -184,7 +185,6 @@ let
       latex foiltex.ins
 
       # Generate the documentation
-      export HOME=.
       latexmk -pdf foiltex.dtx
 
       runHook postBuild

doc/packages/emacs.section.md

@@ -28,80 +28,79 @@ You can install it like any other packages via `nix-env -iA myEmacs`. However, t
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myEmacsConfig = writeText "default.el" ''
-        (eval-when-compile
-          (require 'use-package))
+  packageOverrides = pkgs: {
+    myEmacsConfig = pkgs.writeText "default.el" ''
+      (eval-when-compile
+        (require 'use-package))
 
-        ;; load some packages
+      ;; load some packages
 
-        (use-package company
-          :bind ("<C-tab>" . company-complete)
-          :diminish company-mode
-          :commands (company-mode global-company-mode)
-          :defer 1
-          :config
-          (global-company-mode))
+      (use-package company
+        :bind ("<C-tab>" . company-complete)
+        :diminish company-mode
+        :commands (company-mode global-company-mode)
+        :defer 1
+        :config
+        (global-company-mode))
 
-        (use-package counsel
-          :commands (counsel-descbinds)
-          :bind (([remap execute-extended-command] . counsel-M-x)
-                 ("C-x C-f" . counsel-find-file)
-                 ("C-c g" . counsel-git)
-                 ("C-c j" . counsel-git-grep)
-                 ("C-c k" . counsel-ag)
-                 ("C-x l" . counsel-locate)
-                 ("M-y" . counsel-yank-pop)))
+      (use-package counsel
+        :commands (counsel-descbinds)
+        :bind (([remap execute-extended-command] . counsel-M-x)
+               ("C-x C-f" . counsel-find-file)
+               ("C-c g" . counsel-git)
+               ("C-c j" . counsel-git-grep)
+               ("C-c k" . counsel-ag)
+               ("C-x l" . counsel-locate)
+               ("M-y" . counsel-yank-pop)))
 
-        (use-package flycheck
-          :defer 2
-          :config (global-flycheck-mode))
+      (use-package flycheck
+        :defer 2
+        :config (global-flycheck-mode))
 
-        (use-package ivy
-          :defer 1
-          :bind (("C-c C-r" . ivy-resume)
-                 ("C-x C-b" . ivy-switch-buffer)
-                 :map ivy-minibuffer-map
-                 ("C-j" . ivy-call))
-          :diminish ivy-mode
-          :commands ivy-mode
-          :config
-          (ivy-mode 1))
+      (use-package ivy
+        :defer 1
+        :bind (("C-c C-r" . ivy-resume)
+               ("C-x C-b" . ivy-switch-buffer)
+               :map ivy-minibuffer-map
+               ("C-j" . ivy-call))
+        :diminish ivy-mode
+        :commands ivy-mode
+        :config
+        (ivy-mode 1))
 
-        (use-package magit
-          :defer
-          :if (executable-find "git")
-          :bind (("C-x g" . magit-status)
-                 ("C-x G" . magit-dispatch-popup))
-          :init
-          (setq magit-completing-read-function 'ivy-completing-read))
+      (use-package magit
+        :defer
+        :if (executable-find "git")
+        :bind (("C-x g" . magit-status)
+               ("C-x G" . magit-dispatch-popup))
+        :init
+        (setq magit-completing-read-function 'ivy-completing-read))
 
-        (use-package projectile
-          :commands projectile-mode
-          :bind-keymap ("C-c p" . projectile-command-map)
-          :defer 5
-          :config
-          (projectile-global-mode))
-      '';
+      (use-package projectile
+        :commands projectile-mode
+        :bind-keymap ("C-c p" . projectile-command-map)
+        :defer 5
+        :config
+        (projectile-global-mode))
+    '';
 
-      myEmacs = emacs.pkgs.withPackages (
-        epkgs:
-        (with epkgs.melpaStablePackages; [
-          (runCommand "default.el" { } ''
-            mkdir -p $out/share/emacs/site-lisp
-            cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
-          '')
-          company
-          counsel
-          flycheck
-          ivy
-          magit
-          projectile
-          use-package
-        ])
-      );
-    };
+    myEmacs = emacs.pkgs.withPackages (
+      epkgs:
+      (with epkgs.melpaStablePackages; [
+        (runCommand "default.el" { } ''
+          mkdir -p $out/share/emacs/site-lisp
+          cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
+        '')
+        company
+        counsel
+        flycheck
+        ivy
+        magit
+        projectile
+        use-package
+      ])
+    );
+  };
 }
 ```
 

doc/redirects.json

@@ -431,6 +431,9 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
+  "var-meta-teams": [
+    "index.html#var-meta-teams"
+  ],
   "variables-specifying-dependencies": [
     "index.html#variables-specifying-dependencies"
   ],

doc/stdenv/meta.chapter.md

@@ -91,6 +91,10 @@ For details, see [Source provenance](#sec-meta-sourceProvenance).
 
 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
 
+### `teams` {#var-meta-teams}
+
+A list of the teams of this Nix expression. Teams are defined in [`nixpkgs/maintainers/team-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/team-list.nix), and can be defined in a package with `meta.teams = with lib.teams; [ team1 team2 ]`.
+
 ### `mainProgram` {#var-meta-mainProgram}
 
 The name of the main binary for the package. This affects the binary `nix run` executes. Example: `"rg"`

doc/stdenv/stdenv.chapter.md

@@ -20,14 +20,14 @@ stdenv.mkDerivation {
 **Since [RFC 0035](https://github.com/NixOS/rfcs/pull/35), this is preferred for packages in Nixpkgs**, as it allows us to reuse the version easily:
 
 ```nix
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libfoo";
   version = "1.2.3";
   src = fetchurl {
-    url = "http://example.org/libfoo-source-${version}.tar.bz2";
+    url = "http://example.org/libfoo-source-${finalAttrs.version}.tar.bz2";
     hash = "sha256-tWxU/LANbQE32my+9AXyt3nCT7NBVfJ45CX757EMT3Q=";
   };
-}
+})
 ```
 
 Many packages have dependencies that are not provided in the standard environment. It’s usually sufficient to specify those dependencies in the `buildInputs` attribute:
@@ -53,13 +53,24 @@ Often it is necessary to override or modify some aspect of the build. To make th
 stdenv.mkDerivation {
   pname = "fnord";
   version = "4.5";
+
   # ...
+
   buildPhase = ''
+    runHook preBuild
+
     gcc foo.c -o foo
+
+    runHook postBuild
   '';
+
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     cp foo $out/bin
+
+    runHook postInstall
   '';
 }
 ```
@@ -212,12 +223,12 @@ These dependencies are only injected when [`doCheck`](#var-stdenv-doCheck) is se
 
 Consider for example this simplified derivation for `solo5`, a sandboxing tool:
 ```nix
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "solo5";
   version = "0.7.5";
 
   src = fetchurl {
-    url = "https://github.com/Solo5/solo5/releases/download/v${version}/solo5-v${version}.tar.gz";
+    url = "https://github.com/Solo5/solo5/releases/download/v${finalAttrs.version}/solo5-v${finalAttrs.version}.tar.gz";
     hash = "sha256-viwrS9lnaU8sTGuzK/+L/PlMM/xRRtgVuK5pixVeDEw=";
   };
 
@@ -225,6 +236,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     pkg-config
   ];
+
   buildInputs = [ libseccomp ];
 
   postInstall = ''
@@ -249,8 +261,8 @@ stdenv.mkDerivation rec {
     util-linux
     qemu
   ];
-  checkPhase = ''[elided] '';
-}
+  checkPhase = ''[elided]'';
+})
 ```
 
 - `makeWrapper` is a setup hook, i.e., a shell script sourced by the generic builder of `stdenv`.

doc/using/configuration.chapter.md

@@ -300,42 +300,41 @@ This provides us with some useful documentation for using our packages.  However
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myProfile = writeText "my-profile" ''
-        export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
-        export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
-      '';
-      myPackages = pkgs.buildEnv {
-        name = "my-packages";
-        paths = [
-          (runCommand "profile" { } ''
-            mkdir -p $out/etc/profile.d
-            cp ${myProfile} $out/etc/profile.d/my-profile.sh
-          '')
-          aspell
-          bc
-          coreutils
-          ffmpeg
-          man
-          nix
-          emscripten
-          jq
-          nox
-          silver-searcher
-        ];
-        pathsToLink = [
-          "/share/man"
-          "/share/doc"
-          "/bin"
-          "/etc"
-        ];
-        extraOutputsToInstall = [
-          "man"
-          "doc"
-        ];
-      };
+  packageOverrides = pkgs: {
+    myProfile = pkgs.writeText "my-profile" ''
+      export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+      export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = with pkgs; [
+        (runCommand "profile" { } ''
+          mkdir -p $out/etc/profile.d
+          cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nix
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
+      pathsToLink = [
+        "/share/man"
+        "/share/doc"
+        "/bin"
+        "/etc"
+      ];
+      extraOutputsToInstall = [
+        "man"
+        "doc"
+      ];
     };
+  };
 }
 ```
 
@@ -360,54 +359,53 @@ Configuring GNU info is a little bit trickier than man pages. To work correctly,
 
 ```nix
 {
-  packageOverrides =
-    pkgs: with pkgs; rec {
-      myProfile = writeText "my-profile" ''
-        export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
-        export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
-        export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
+  packageOverrides = pkgs: {
+    myProfile = pkgs.writeText "my-profile" ''
+      export PATH=$HOME/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/sbin:/bin:/usr/sbin:/usr/bin
+      export MANPATH=$HOME/.nix-profile/share/man:/nix/var/nix/profiles/default/share/man:/usr/share/man
+      export INFOPATH=$HOME/.nix-profile/share/info:/nix/var/nix/profiles/default/share/info:/usr/share/info
+    '';
+    myPackages = pkgs.buildEnv {
+      name = "my-packages";
+      paths = with pkgs; [
+        (runCommand "profile" { } ''
+          mkdir -p $out/etc/profile.d
+          cp ${myProfile} $out/etc/profile.d/my-profile.sh
+        '')
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        man
+        nix
+        emscripten
+        jq
+        nox
+        silver-searcher
+        texinfoInteractive
+      ];
+      pathsToLink = [
+        "/share/man"
+        "/share/doc"
+        "/share/info"
+        "/bin"
+        "/etc"
+      ];
+      extraOutputsToInstall = [
+        "man"
+        "doc"
+        "info"
+      ];
+      postBuild = ''
+        if [ -x $out/bin/install-info -a -w $out/share/info ]; then
+          shopt -s nullglob
+          for i in $out/share/info/*.info $out/share/info/*.info.gz; do
+              $out/bin/install-info $i $out/share/info/dir
+          done
+        fi
       '';
-      myPackages = pkgs.buildEnv {
-        name = "my-packages";
-        paths = [
-          (runCommand "profile" { } ''
-            mkdir -p $out/etc/profile.d
-            cp ${myProfile} $out/etc/profile.d/my-profile.sh
-          '')
-          aspell
-          bc
-          coreutils
-          ffmpeg
-          man
-          nix
-          emscripten
-          jq
-          nox
-          silver-searcher
-          texinfoInteractive
-        ];
-        pathsToLink = [
-          "/share/man"
-          "/share/doc"
-          "/share/info"
-          "/bin"
-          "/etc"
-        ];
-        extraOutputsToInstall = [
-          "man"
-          "doc"
-          "info"
-        ];
-        postBuild = ''
-          if [ -x $out/bin/install-info -a -w $out/share/info ]; then
-            shopt -s nullglob
-            for i in $out/share/info/*.info $out/share/info/*.info.gz; do
-                $out/bin/install-info $i $out/share/info/dir
-            done
-          fi
-        '';
-      };
     };
+  };
 }
 ```
 

maintainers/maintainer-list.nix

@@ -22870,6 +22870,12 @@
     githubId = 10437171;
     keys = [ { fingerprint = "75F0 AB7C FE01 D077 AEE6  CAFD 353E 4A18 EE0F AB72"; } ];
   };
+  spacedentist = {
+    email = "sp@cedenti.st";
+    github = "spacedentist";
+    githubId = 1536420;
+    name = "Sven Over";
+  };
   spacefrogg = {
     email = "spacefrogg-nixos@meterriblecrew.net";
     github = "spacefrogg";
@@ -23408,12 +23414,6 @@
     githubId = 306190;
     name = "Svend Sorensen";
   };
-  sven-of-cord = {
-    email = "sven@cord.com";
-    github = "sven-of-cord";
-    githubId = 98333944;
-    name = "Sven Over";
-  };
   Svenum = {
     email = "s.ziegler@holypenguin.net";
     github = "Svenum";

maintainers/scripts/README.md

@@ -57,6 +57,17 @@ The maintainer is designated by a `selector` which must be one of:
 
 [`maintainer-list.nix`]: ../maintainer-list.nix
 
+### `get-maintainer-pings-between.sh`
+
+Gets which maintainers would be pinged between two Nixpkgs revisions.
+Outputs a JSON object on stdout mapping GitHub usernames to the attributes
+that they would be getting pinged for.
+
+Example:
+
+```sh
+maintainers/scripts/get-maintainer-pings-between.sh HEAD^ HEAD
+```
 
 ## Conventions
 

maintainers/scripts/get-maintainer-pings-between.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p git jq
+
+# Outputs a list of maintainers that would be pinged across two nixpkgs revisions.
+# Authors:
+#  Morgan Jones (@numinit)
+#  Tristan Ross (@RossComputerGuy)
+
+set -euo pipefail
+
+if [ $# -lt 2 ]; then
+    echo "Usage: $0 <rev-from> <rev-to>" >&2
+    exit 1
+fi
+
+repo="$(git rev-parse --show-toplevel)"
+system="$(nix-instantiate --eval --expr builtins.currentSystem)"
+rev1="$(git -C "$repo" rev-parse "$1")"
+rev2="$(git -C "$repo" rev-parse "$2")"
+
+echo "Touched files:" >&2
+git -C "$repo" diff --name-only "$rev1" "$rev2" \
+    | jq --raw-input --slurp 'split("\n")[:-1]' | tee "$TMPDIR/touched-files.json" >&2
+
+# Runs an eval in the given worktree, outputting the path to $TMPDIR/$1.path.
+# $1: The revision SHA.
+eval_in_worktree() (
+    mkdir -p .worktree
+    local rev="$1"
+    local tree=".worktree/$rev"
+    if [ ! -d "$tree" ]; then
+        git -C "$repo" worktree add -f -d "$tree" "$rev" >&2
+    fi
+    cd "$tree"
+
+    local workdir="$TMPDIR/$rev"
+    rm -rf "$workdir"
+    mkdir -p "$workdir"
+
+    nix-build ci -A eval.attrpathsSuperset -o "$workdir/paths" >&2
+    mkdir -p "$workdir/intermediates"
+    nix-build ci -A eval.singleSystem \
+        --arg evalSystem "$system" \
+        --arg attrpathFile "$workdir/paths/paths.json" \
+        --arg chunkSize ${CHUNK_SIZE:-10000} \
+        -o "$workdir/intermediates/.intermediate-1" >&2
+
+    # eval.combine nix-build needs a directory, not a symlink
+    cp -RL "$workdir/intermediates/.intermediate-1" "$workdir/intermediates/intermediate-1"
+    chmod -R +w "$workdir/intermediates/intermediate-1"
+    rm -rf "$workdir/intermediates/.intermediate-1"
+
+    nix-build ci -A eval.combine \
+        --arg resultsDir "$workdir/intermediates" \
+        -o "$workdir/result" >&2
+)
+
+eval_in_worktree "$rev1" &
+pid1=$!
+eval_in_worktree "$rev2" &
+pid2=$!
+
+wait $pid1
+wait $pid2
+
+path1="$TMPDIR/$rev1"
+path2="$TMPDIR/$rev2"
+
+# Use the repo this script was executed in to get accurate maintainer info
+nix-build "$repo/ci" -A eval.compare \
+    --arg beforeResultDir "$path1/result" \
+    --arg afterResultDir "$path2/result" \
+    --arg touchedFilesJson "$TMPDIR/touched-files.json" \
+    --arg byName true \
+    -o comparison
+
+echo "Pinged maintainers (check $repo/comparison for more details)" >&2
+jq < comparison/maintainers.json

nixos/doc/manual/development/nixos-tests.chapter.md

@@ -10,4 +10,5 @@ writing-nixos-tests.section.md
 running-nixos-tests.section.md
 running-nixos-tests-interactively.section.md
 linking-nixos-tests-to-packages.section.md
+testing-hardware-features.section.md
 ```

nixos/doc/manual/development/testing-hardware-features.section.md

@@ -0,0 +1,152 @@
+# Testing Hardware Features {#sec-nixos-test-testing-hardware-features}
+
+This section covers how to test various features using NixOS tests that would
+normally only be possible with hardware. It is designed to showcase the NixOS test
+framework's flexibility when combined with various hardware simulation libraries
+or kernel modules.
+
+## Wi-Fi {#sec-nixos-test-wifi}
+
+Use `services.vwifi` to set up a virtual Wi-Fi physical layer. Create at least two nodes
+for this kind of test: one with vwifi active, and either a station or an access point.
+Give each a static IP address on the test network so they will never collide.
+This module likely supports other topologies too; document them if you make one.
+
+This NixOS module leverages [vwifi](https://github.com/Raizo62/vwifi). Read the
+upstream repository's documentation for more information.
+
+### vwifi server {#sec-nixos-test-wifi-vwifi-server}
+
+This node runs the vwifi server, and otherwise does not interact with the network.
+You can run `vwifi-ctrl` on this node to control characteristics of the simulated
+physical layer.
+
+```nix
+airgap =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.2";
+        prefixLength = 24;
+      }
+    ];
+    services.vwifi = {
+      server = {
+        enable = true;
+        ports.tcp = 8212;
+        # uncomment if you want to enable monitor mode on another node
+        # ports.spy = 8213;
+        openFirewall = true;
+      };
+    };
+  };
+```
+
+### AP {#sec-nixos-test-wifi-ap}
+
+A node like this will act as a wireless access point in infrastructure mode.
+
+```nix
+ap =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.3";
+        prefixLength = 24;
+      }
+    ];
+    services.hostapd = {
+      enable = true;
+      radios.wlan0 = {
+        channel = 1;
+        networks.wlan0 = {
+          ssid = "NixOS Test Wi-Fi Network";
+          authentication = {
+            mode = "wpa3-sae";
+            saePasswords = [ { password = "supersecret"; } ];
+            enableRecommendedPairwiseCiphers = true;
+          };
+        };
+      };
+    };
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:01";
+      };
+      client = {
+        enable = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+  };
+```
+
+### Station {#sec-nixos-test-wifi-station}
+
+A node like this acts as a wireless client.
+
+```nix
+station =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.3";
+        prefixLength = 24;
+      }
+    ];
+    networking.wireless = {
+      # No, really, we want it enabled!
+      enable = lib.mkOverride 0 true;
+      interfaces = [ "wlan0" ];
+      networks = {
+        "NixOS Test Wi-Fi Network" = {
+          psk = "supersecret";
+          authProtocols = [ "SAE" ];
+        };
+      };
+    };
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:02";
+      };
+      client = {
+        enable = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+  };
+```
+
+### Monitor {#sec-nixos-test-wifi-monitor}
+
+When the monitor mode interface is enabled, this node will receive
+all packets broadcast by all other nodes through the spy interface.
+
+```nix
+monitor =
+  { config, ... }:
+  {
+    networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+      {
+        address = "192.168.1.4";
+        prefixLength = 24;
+      }
+    ];
+
+    services.vwifi = {
+      module = {
+        enable = true;
+        macPrefix = "74:F8:F6:00:03";
+      };
+      client = {
+        enable = true;
+        spy = true;
+        serverAddress = "192.168.1.2";
+      };
+    };
+```

nixos/doc/manual/redirects.json

@@ -77,6 +77,21 @@
   "sec-mattermost-plugins-build": [
     "index.html#sec-mattermost-plugins-build"
   ],
+  "sec-nixos-test-wifi": [
+    "index.html#sec-nixos-test-wifi"
+  ],
+  "sec-nixos-test-wifi-ap": [
+    "index.html#sec-nixos-test-wifi-ap"
+  ],
+  "sec-nixos-test-wifi-monitor": [
+    "index.html#sec-nixos-test-wifi-monitor"
+  ],
+  "sec-nixos-test-wifi-station": [
+    "index.html#sec-nixos-test-wifi-station"
+  ],
+  "sec-nixos-test-wifi-vwifi-server": [
+    "index.html#sec-nixos-test-wifi-vwifi-server"
+  ],
   "sec-obtaining": [
     "index.html#sec-obtaining"
   ],
@@ -1895,6 +1910,9 @@
   "sec-linking-nixos-tests-to-packages": [
     "index.html#sec-linking-nixos-tests-to-packages"
   ],
+  "sec-nixos-test-testing-hardware-features": [
+    "index.html#sec-nixos-test-testing-hardware-features"
+  ],
   "chap-developing-the-test-driver": [
     "index.html#chap-developing-the-test-driver"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -36,7 +36,6 @@
   - `services.mattermost.listenAddress` has been split into {option}`services.mattermost.host` and {option}`services.mattermost.port`. If your `listenAddress` contained a port, you will need to edit your configuration.
   - Mattermost now supports peer authentication on both MySQL and Postgres database backends. Updating {option}`system.stateVersion` to 25.05 or later will result in peer authentication being used by default if the Mattermost server would otherwise be connecting to localhost. This is the recommended configuration.
   - The Mattermost module will produce eval warnings if a database password would end up in the Nix store, and recommend alternatives such as peer authentication or using the environment file.
-  - Mattermost's entire test suite is now enabled by default, which will extend build time from sources by up to an hour. A `withoutTests` passthru has been added in case you want to skip it.
   - We now support `mmctl` for Mattermost administration if both {option}`services.mattermost.socket.enable` and {option}`services.mattermost.socket.export` are set, which export the Mattermost control socket path into the system environment.
   - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
   - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
@@ -59,6 +58,10 @@
 
 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
 
+- [Kismet](https://www.kismetwireless.net/), a Wi-Fi, Bluetooth, and RF monitoring application supporting a wide range of hardware. Available as {option}`services.kismet`.
+
+- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
+
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
 - [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
@@ -527,6 +530,8 @@
 
 - [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
 
+- There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the {option}`services.vwifi` module, {option}`services.kismet` NixOS test, and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-nixos-test-wifi) for documentation and examples.
+
 - The paperless module now has an option for regular automatic export of
   documents data using the integrated document exporter.
 

nixos/modules/module-list.nix

@@ -1175,6 +1175,7 @@
   ./services/networking/kea.nix
   ./services/networking/keepalived/default.nix
   ./services/networking/keybase.nix
+  ./services/networking/kismet.nix
   ./services/networking/knot.nix
   ./services/networking/kresd.nix
   ./services/networking/lambdabot.nix
@@ -1352,6 +1353,7 @@
   ./services/networking/veilid.nix
   ./services/networking/vdirsyncer.nix
   ./services/networking/vsftpd.nix
+  ./services/networking/vwifi.nix
   ./services/networking/wasabibackend.nix
   ./services/networking/websockify.nix
   ./services/networking/wg-access-server.nix

nixos/modules/services/networking/kismet.nix

@@ -0,0 +1,459 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib.trivial) isFloat isInt isBool;
+  inherit (lib.modules) mkIf;
+  inherit (lib.options)
+    literalExpression
+    mkOption
+    mkPackageOption
+    mkEnableOption
+    ;
+  inherit (lib.strings)
+    isString
+    escapeShellArg
+    escapeShellArgs
+    concatMapStringsSep
+    concatMapAttrsStringSep
+    replaceStrings
+    substring
+    stringLength
+    hasInfix
+    hasSuffix
+    typeOf
+    match
+    ;
+  inherit (lib.lists) all isList flatten;
+  inherit (lib.attrsets)
+    attrsToList
+    filterAttrs
+    optionalAttrs
+    mapAttrs'
+    mapAttrsToList
+    nameValuePair
+    ;
+  inherit (lib.generators) toKeyValue;
+  inherit (lib) types;
+
+  # Deeply checks types for a given type function. Calls `override` with type and value.
+  deep =
+    func: override: type:
+    let
+      prev = func type;
+    in
+    prev
+    // {
+      check = value: prev.check value && (override type value);
+    };
+
+  # Deep listOf.
+  listOf' = deep types.listOf (type: value: all type.check value);
+
+  # Deep attrsOf.
+  attrsOf' = deep types.attrsOf (type: value: all (item: type.check item.value) (attrsToList value));
+
+  # Kismet config atoms.
+  atom =
+    with types;
+    oneOf [
+      number
+      bool
+      str
+    ];
+
+  # Composite types.
+  listOfAtom = listOf' atom;
+  atomOrList = with types; either atom listOfAtom;
+  lists = listOf' atomOrList;
+  kvPair = attrsOf' atomOrList;
+  kvPairs = listOf' kvPair;
+
+  # Options that eval to a string with a header (foo:key=value)
+  headerKvPair = attrsOf' (attrsOf' atomOrList);
+  headerKvPairs = attrsOf' (listOf' (attrsOf' atomOrList));
+
+  # Toplevel config type.
+  topLevel =
+    let
+      topLevel' =
+        with types;
+        oneOf [
+          headerKvPairs
+          headerKvPair
+          kvPairs
+          kvPair
+          listOfAtom
+          lists
+          atom
+        ];
+    in
+    topLevel'
+    // {
+      description = "Kismet config stanza";
+    };
+
+  # Throws invalid.
+  invalid = atom: throw "invalid value '${toString atom}' of type '${typeOf atom}'";
+
+  # Converts an atom.
+  mkAtom =
+    atom:
+    if isString atom then
+      if hasInfix "\"" atom || hasInfix "," atom then
+        ''"${replaceStrings [ ''"'' ] [ ''\"'' ] atom}"''
+      else
+        atom
+    else if isFloat atom || isInt atom || isBool atom then
+      toString atom
+    else
+      invalid atom;
+
+  # Converts an inline atom or list to a string.
+  mkAtomOrListInline =
+    atomOrList:
+    if isList atomOrList then
+      mkAtom "${concatMapStringsSep "," mkAtom atomOrList}"
+    else
+      mkAtom atomOrList;
+
+  # Converts an out of line atom or list to a string.
+  mkAtomOrList =
+    atomOrList:
+    if isList atomOrList then
+      "${concatMapStringsSep "," mkAtomOrListInline atomOrList}"
+    else
+      mkAtom atomOrList;
+
+  # Throws if the string matches the given regex.
+  deny =
+    regex: str:
+    assert (match regex str) == null;
+    str;
+
+  # Converts a set of k/v pairs.
+  convertKv = concatMapAttrsStringSep "," (
+    name: value: "${mkAtom (deny "=" name)}=${mkAtomOrListInline value}"
+  );
+
+  # Converts k/v pairs with a header.
+  convertKvWithHeader = header: attrs: "${mkAtom (deny ":" header)}:${convertKv attrs}";
+
+  # Converts the entire config.
+  convertConfig = mapAttrs' (
+    name: value:
+    let
+      # Convert foo' into 'foo+' for support for '+=' syntax.
+      newName = if hasSuffix "'" name then substring 0 (stringLength name - 1) name + "+" else name;
+
+      # Get the stringified value.
+      newValue =
+        if headerKvPairs.check value then
+          flatten (
+            mapAttrsToList (header: values: (map (value: convertKvWithHeader header value) values)) value
+          )
+        else if headerKvPair.check value then
+          mapAttrsToList convertKvWithHeader value
+        else if kvPairs.check value then
+          map convertKv value
+        else if kvPair.check value then
+          convertKv value
+        else if listOfAtom.check value then
+          mkAtomOrList value
+        else if lists.check value then
+          map mkAtomOrList value
+        else if atom.check value then
+          mkAtom value
+        else
+          invalid value;
+    in
+    nameValuePair newName newValue
+  );
+
+  mkKismetConf =
+    options:
+    (toKeyValue { listsAsDuplicateKeys = true; }) (
+      filterAttrs (_: value: value != null) (convertConfig options)
+    );
+
+  cfg = config.services.kismet;
+in
+{
+  options.services.kismet = {
+    enable = mkEnableOption "kismet";
+    package = mkPackageOption pkgs "kismet" { };
+    user = mkOption {
+      description = "The user to run Kismet as.";
+      type = types.str;
+      default = "kismet";
+    };
+    group = mkOption {
+      description = "The group to run Kismet as.";
+      type = types.str;
+      default = "kismet";
+    };
+    serverName = mkOption {
+      description = "The name of the server.";
+      type = types.str;
+      default = "Kismet";
+    };
+    serverDescription = mkOption {
+      description = "The description of the server.";
+      type = types.str;
+      default = "NixOS Kismet server";
+    };
+    logTypes = mkOption {
+      description = "The log types.";
+      type = with types; listOf str;
+      default = [ "kismet" ];
+    };
+    dataDir = mkOption {
+      description = "The Kismet data directory.";
+      type = types.path;
+      default = "/var/lib/kismet";
+    };
+    httpd = {
+      enable = mkOption {
+        description = "True to enable the HTTP server.";
+        type = types.bool;
+        default = false;
+      };
+      address = mkOption {
+        description = "The address to listen on. Note that this cannot be a hostname or Kismet will not start.";
+        type = types.str;
+        default = "127.0.0.1";
+      };
+      port = mkOption {
+        description = "The port to listen on.";
+        type = types.port;
+        default = 2501;
+      };
+    };
+    settings = mkOption {
+      description = ''
+        Options for Kismet. See:
+        https://www.kismetwireless.net/docs/readme/configuring/configfiles/
+      '';
+      default = { };
+      type = with types; attrsOf topLevel;
+      example = literalExpression ''
+        {
+          /* Examples for atoms */
+          # dot11_link_bssts=false
+          dot11_link_bssts = false; # Boolean
+
+          # dot11_related_bss_window=10000000
+          dot11_related_bss_window = 10000000; # Integer
+
+          # devicefound=00:11:22:33:44:55
+          devicefound = "00:11:22:33:44:55"; # String
+
+          # log_types+=wiglecsv
+          log_types' = "wiglecsv";
+
+          /* Examples for lists of atoms */
+          # wepkey=00:DE:AD:C0:DE:00,FEEDFACE42
+          wepkey = [ "00:DE:AD:C0:DE:00" "FEEDFACE42" ];
+
+          # alert=ADHOCCONFLICT,5/min,1/sec
+          # alert=ADVCRYPTCHANGE,5/min,1/sec
+          alert = [
+            [ "ADHOCCONFLICT"  "5/min" "1/sec" ]
+            [ "ADVCRYPTCHANGE" "5/min" "1/sec" ]
+          ];
+
+          /* Examples for sets of atoms */
+          # source=wlan0:name=ath11k
+          source.wlan0 = { name = "ath11k"; };
+
+          /* Examples with colon-suffixed headers */
+          # gps=gpsd:host=localhost,port=2947
+          gps.gpsd = {
+            host = "localhost";
+            port = 2947;
+          };
+
+          # apspoof=Foo1:ssid=Bar1,validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"
+          # apspoof=Foo1:ssid=Bar2,validmacs="01:12:23:34:45:56,ab:bc:cd:de:ef:f0"
+          # apspoof=Foo2:ssid=Baz1,validmacs="11:22:33:44:55:66,bb:cc:dd:ee:ff:00"
+          apspoof.Foo1 = [
+            { ssid = "Bar1"; validmacs = [ "00:11:22:33:44:55" "aa:bb:cc:dd:ee:ff" ]; }
+            { ssid = "Bar2"; validmacs = [ "01:12:23:34:45:56" "ab:bc:cd:de:ef:f0" ]; }
+          ];
+
+          # because Foo1 is a list, Foo2 needs to be as well
+          apspoof.Foo2 = [
+            {
+              ssid = "Bar2";
+              validmacs = [ "00:11:22:33:44:55" "aa:bb:cc:dd:ee:ff" ];
+            };
+          ];
+        }
+      '';
+    };
+    extraConfig = mkOption {
+      description = ''
+        Literal Kismet config lines appended to the site config.
+        Note that `services.kismet.settings` allows you to define
+        all options here using Nix attribute sets.
+      '';
+      default = "";
+      type = types.str;
+      example = ''
+        # Looks like the following in `services.kismet.settings`:
+        # wepkey = [ "00:DE:AD:C0:DE:00" "FEEDFACE42" ];
+        wepkey=00:DE:AD:C0:DE:00,FEEDFACE42
+      '';
+    };
+  };
+
+  config =
+    let
+      configDir = "${cfg.dataDir}/.kismet";
+      settings =
+        cfg.settings
+        // {
+          server_name = cfg.serverName;
+          server_description = cfg.serverDescription;
+          logging_enabled = cfg.logTypes != [ ];
+          log_types = cfg.logTypes;
+        }
+        // optionalAttrs cfg.httpd.enable {
+          httpd_bind_address = cfg.httpd.address;
+          httpd_port = cfg.httpd.port;
+          httpd_auth_file = "${configDir}/kismet_httpd.conf";
+          httpd_home = "${cfg.package}/share/kismet/httpd";
+        };
+    in
+    mkIf cfg.enable {
+      systemd.tmpfiles.settings = {
+        "10-kismet" = {
+          ${cfg.dataDir} = {
+            d = {
+              inherit (cfg) user group;
+              mode = "0750";
+            };
+          };
+          ${configDir} = {
+            d = {
+              inherit (cfg) user group;
+              mode = "0750";
+            };
+          };
+        };
+      };
+      systemd.services.kismet =
+        let
+          kismetConf = pkgs.writeText "kismet.conf" ''
+            ${mkKismetConf settings}
+            ${cfg.extraConfig}
+          '';
+        in
+        {
+          description = "Kismet monitoring service";
+          wants = [ "basic.target" ];
+          after = [
+            "basic.target"
+            "network.target"
+          ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig =
+            let
+              capabilities = [
+                "CAP_NET_ADMIN"
+                "CAP_NET_RAW"
+              ];
+              kismetPreStart = pkgs.writeShellScript "kismet-pre-start" ''
+                owner=${escapeShellArg "${cfg.user}:${cfg.group}"}
+                mkdir -p ~/.kismet
+
+                # Ensure permissions on directories Kismet uses.
+                chown "$owner" ~/ ~/.kismet
+                cd ~/.kismet
+
+                package=${cfg.package}
+                if [ -d "$package/etc" ]; then
+                  for file in "$package/etc"/*.conf; do
+                    # Symlink the config files if they exist or are already a link.
+                    base="''${file##*/}"
+                    if [ ! -f "$base" ] || [ -L "$base" ]; then
+                      ln -sf "$file" "$base"
+                    fi
+                  done
+                fi
+
+                for file in kismet_httpd.conf; do
+                  # Un-symlink these files.
+                  if [ -L "$file" ]; then
+                    cp "$file" ".$file"
+                    rm -f "$file"
+                    mv ".$file" "$file"
+                    chmod 0640 "$file"
+                    chown "$owner" "$file"
+                  fi
+                done
+
+                # Link the site config.
+                ln -sf ${kismetConf} kismet_site.conf
+              '';
+            in
+            {
+              Type = "simple";
+              ExecStart = escapeShellArgs [
+                "${cfg.package}/bin/kismet"
+                "--homedir"
+                cfg.dataDir
+                "--confdir"
+                configDir
+                "--datadir"
+                "${cfg.package}/share"
+                "--no-ncurses"
+                "-f"
+                "${configDir}/kismet.conf"
+              ];
+              WorkingDirectory = cfg.dataDir;
+              ExecStartPre = "+${kismetPreStart}";
+              Restart = "always";
+              KillMode = "control-group";
+              CapabilityBoundingSet = capabilities;
+              AmbientCapabilities = capabilities;
+              LockPersonality = true;
+              NoNewPrivileges = true;
+              PrivateDevices = false;
+              PrivateTmp = true;
+              PrivateUsers = false;
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHome = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectProc = "invisible";
+              ProtectSystem = "full";
+              RestrictNamespaces = true;
+              RestrictSUIDSGID = true;
+              User = cfg.user;
+              Group = cfg.group;
+              UMask = "0007";
+              TimeoutStopSec = 30;
+            };
+
+          # Allow it to restart if the wifi interface is not up
+          unitConfig.StartLimitIntervalSec = 5;
+        };
+      users.groups.${cfg.group} = { };
+      users.users.${cfg.user} = {
+        inherit (cfg) group;
+        description = "User for running Kismet";
+        isSystemUser = true;
+        home = cfg.dataDir;
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [ numinit ];
+}

nixos/modules/services/networking/vwifi.nix

@@ -0,0 +1,200 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib.modules) mkIf mkMerge;
+  inherit (lib.options) mkOption mkPackageOption mkEnableOption;
+  inherit (lib.lists) optional optionals;
+  inherit (lib.strings)
+    hasSuffix
+    escapeShellArgs
+    ;
+  inherit (lib) types;
+  cfg = config.services.vwifi;
+in
+{
+  options = {
+    services.vwifi =
+      let
+        mkOptionalPort =
+          name:
+          mkOption {
+            description = ''
+              The ${name} port. Set to null if we should leave it unset.
+            '';
+            type = with types; nullOr port;
+            default = null;
+          };
+      in
+      {
+        package = mkPackageOption pkgs "vwifi" { };
+        module = {
+          enable = mkEnableOption "mac80211_hwsim module";
+          numRadios = mkOption {
+            description = "The number of virtual radio interfaces to create.";
+            type = types.int;
+            default = 1;
+          };
+          macPrefix = mkOption {
+            description = ''
+              The prefix for MAC addresses to use, without the trailing ':'.
+              If one radio is created, you can specify the whole MAC address here.
+              The default is defined in vwifi/src/config.h.
+            '';
+            type = types.strMatching "^(([0-9A-Fa-f]{2}:){0,5}[0-9A-Fa-f]{2})$";
+            default = "74:F8:F6";
+          };
+        };
+        client = {
+          enable = mkEnableOption "vwifi client";
+          spy = mkEnableOption "spy mode, useful for wireless monitors";
+          serverAddress = mkOption {
+            description = ''
+              The address of the server. If set to null, will try to use the vsock protocol.
+              Note that this assumes that the server is spawned on the host and passed through to
+              QEMU, with something like:
+
+              -device vhost-vsock-pci,id=vwifi0,guest-cid=42
+            '';
+            type = with types; nullOr str;
+            default = null;
+          };
+          serverPort = mkOptionalPort "server port";
+          extraArgs = mkOption {
+            description = ''
+              Extra arguments to pass to vwifi-client. You can use this if you want to bring
+              the radios up using vwifi-client instead of at boot.
+            '';
+            type = with types; listOf str;
+            default = [ ];
+            example = [
+              "--number"
+              "3"
+            ];
+          };
+        };
+        server = {
+          enable = mkEnableOption "vwifi server";
+          vsock.enable = mkEnableOption "vsock kernel module";
+          ports = {
+            vhost = mkOptionalPort "vhost";
+            tcp = mkOptionalPort "TCP server";
+            spy = mkOptionalPort "spy interface";
+            control = mkOptionalPort "control interface";
+          };
+          openFirewall = mkEnableOption "opening the firewall for the TCP and spy ports";
+          extraArgs = mkOption {
+            description = ''
+              Extra arguments to pass to vwifi-server. You can use this for things including
+              changing the ports or inducing packet loss.
+            '';
+            type = with types; listOf str;
+            default = [ ];
+            example = [ "--lost-packets" ];
+          };
+        };
+      };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.module.enable {
+      boot.kernelModules = [
+        "mac80211_hwsim"
+      ];
+      boot.extraModprobeConfig = ''
+        # We'll add more radios using vwifi-add-interfaces in the systemd unit.
+        options mac80211_hwsim radios=0
+      '';
+      systemd.services.vwifi-add-interfaces = mkIf (cfg.module.numRadios > 0) {
+        description = "vwifi interface bringup";
+        wantedBy = [ "network-pre.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart =
+            let
+              args = [
+                (toString cfg.module.numRadios)
+                cfg.module.macPrefix
+              ];
+            in
+            "${cfg.package}/bin/vwifi-add-interfaces ${escapeShellArgs args}";
+        };
+      };
+      assertions = [
+        {
+          assertion = !(hasSuffix ":" cfg.module.macPrefix);
+          message = ''
+            services.vwifi.module.macPrefix should not have a trailing ":".
+          '';
+        }
+      ];
+    })
+    (mkIf cfg.client.enable {
+      systemd.services.vwifi-client =
+        let
+          clientArgs =
+            optional cfg.client.spy "--spy"
+            ++ optional (cfg.client.serverAddress != null) cfg.client.serverAddress
+            ++ optionals (cfg.client.serverPort != null) [
+              "--port"
+              cfg.client.serverPort
+            ]
+            ++ cfg.client.extraArgs;
+        in
+        rec {
+          description = "vwifi client";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          requires = after;
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/vwifi-client ${escapeShellArgs clientArgs}";
+          };
+        };
+    })
+    (mkIf cfg.server.enable {
+      boot.kernelModules = mkIf cfg.server.vsock.enable [
+        "vhost_vsock"
+      ];
+      networking.firewall.allowedTCPPorts = mkIf cfg.server.openFirewall (
+        optional (cfg.server.ports.tcp != null) cfg.server.ports.tcp
+        ++ optional (cfg.server.ports.spy != null) cfg.server.ports.spy
+      );
+      systemd.services.vwifi-server =
+        let
+          serverArgs =
+            optionals (cfg.server.ports.vhost != null) [
+              "--port-vhost"
+              (toString cfg.server.ports.vhost)
+            ]
+            ++ optionals (cfg.server.ports.tcp != null) [
+              "--port-tcp"
+              (toString cfg.server.ports.tcp)
+            ]
+            ++ optionals (cfg.server.ports.spy != null) [
+              "--port-spy"
+              (toString cfg.server.ports.spy)
+            ]
+            ++ optionals (cfg.server.ports.control != null) [
+              "--port-ctrl"
+              (toString cfg.server.ports.control)
+            ]
+            ++ cfg.server.extraArgs;
+        in
+        rec {
+          description = "vwifi server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          requires = after;
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/vwifi-server ${escapeShellArgs serverArgs}";
+          };
+        };
+    })
+  ];
+
+  meta.maintainers = with lib.maintainers; [ numinit ];
+}

nixos/modules/services/web-apps/mattermost.nix

@@ -41,9 +41,15 @@ let
   # The directory to store mutable data within dataDir.
   mutableDataDir = "${cfg.dataDir}/data";
 
-  # The plugin directory. Note that this is the *post-unpack* plugin directory,
-  # since Mattermost unpacks plugins to put them there. (Hence, mutable data.)
-  pluginDir = "${mutableDataDir}/plugins";
+  # The plugin directory. Note that this is the *pre-unpack* plugin directory,
+  # since Mattermost looks in mutableDataDir for a directory called "plugins".
+  # If Mattermost is installed with plugins defined in a Nix configuration, the plugins
+  # are symlinked here. Otherwise, this is a real directory and the tarballs are uploaded here.
+  pluginTarballDir = "${mutableDataDir}/plugins";
+
+  # We need a different unpack directory for Mattermost to sync things to at launch,
+  # since the above may be a symlink to the store.
+  pluginUnpackDir = "${mutableDataDir}/.plugins";
 
   # Mattermost uses this as a staging directory to unpack plugins, among possibly other things.
   # Ensure that it's inside mutableDataDir since it can get rather large.
@@ -232,9 +238,12 @@ let
           services.mattermost.environmentFile = "<your environment file>";
           services.mattermost.database.fromEnvironment = true;
         '' database;
-    FileSettings.Directory = cfg.dataDir;
-    PluginSettings.Directory = "${pluginDir}/server";
-    PluginSettings.ClientDirectory = "${pluginDir}/client";
+
+    # Note that the plugin tarball directory is not configurable, and is expected to be in FileSettings.Directory/plugins.
+    FileSettings.Directory = mutableDataDir;
+    PluginSettings.Directory = "${pluginUnpackDir}/server";
+    PluginSettings.ClientDirectory = "${pluginUnpackDir}/client";
+
     LogSettings = {
       FileLocation = cfg.logDir;
 
@@ -800,9 +809,9 @@ in
           "R- ${tempDir} - - - - -"
           "d= ${tempDir} 0750 ${cfg.user} ${cfg.group} - -"
 
-          # Ensure that pluginDir is a directory, as it could be a symlink on prior versions.
+          # Ensure that pluginUnpackDir is a directory.
           # Don't remove or clean it out since it should be persistent, as this is where plugins are unpacked.
-          "d= ${pluginDir} 0750 ${cfg.user} ${cfg.group} - -"
+          "d= ${pluginUnpackDir} 0750 ${cfg.user} ${cfg.group} - -"
 
           # Ensure that the plugin directories exist.
           "d= ${mattermostConf.PluginSettings.Directory} 0750 ${cfg.user} ${cfg.group} - -"
@@ -819,11 +828,11 @@ in
           if cfg.pluginsBundle == null then
             # Create the plugin tarball directory to allow plugin uploads.
             [
-              "d= ${cfg.dataDir}/plugins 0750 ${cfg.user} ${cfg.group} - -"
+              "d= ${pluginTarballDir} 0750 ${cfg.user} ${cfg.group} - -"
             ]
           else
             # Symlink the plugin tarball directory, removing anything existing, since it's managed by Nix.
-            [ "L+ ${cfg.dataDir}/plugins - - - - ${cfg.pluginsBundle}" ]
+            [ "L+ ${pluginTarballDir} - - - - ${cfg.pluginsBundle}" ]
         );
 
       systemd.services.mattermost = rec {
@@ -867,12 +876,13 @@ in
             # Logs too.
             oldLogs="$dataDir/logs"
             newLogs="$logDir"
-            if [ "$oldLogs" != "$newLogs" ] && [ -d "$oldLogs" ]; then
+            if [ "$oldLogs" != "$newLogs" ] && [ -d "$oldLogs" ] && [ ! -f "$newLogs/.initial-created" ]; then
               # Migrate the legacy log location to the new log location.
               # Allow this to fail if there aren't any logs to move.
               echo "Moving legacy logs at $oldLogs to $newLogs" >&2
               mkdir -p "$newLogs"
               mv "$oldLogs"/* "$newLogs" || true
+              touch "$newLogs/.initial-created"
             fi
           ''
           + optionalString (!cfg.mutableConfig) ''

nixos/tests/all-tests.nix

@@ -702,6 +702,7 @@ in
   keyd = handleTest ./keyd.nix { };
   keymap = handleTest ./keymap.nix { };
   kimai = runTest ./kimai.nix;
+  kismet = runTest ./kismet.nix;
   kmonad = runTest ./kmonad.nix;
   knot = runTest ./knot.nix;
   komga = handleTest ./komga.nix { };

nixos/tests/kismet.nix

@@ -0,0 +1,266 @@
+{ pkgs, lib, ... }:
+
+let
+  ssid = "Hydra SmokeNet";
+  psk = "stayoffmywifi";
+  wlanInterface = "wlan0";
+in
+{
+  name = "kismet";
+
+  nodes =
+    let
+      hostAddress = id: "192.168.1.${toString (id + 1)}";
+      serverAddress = hostAddress 1;
+    in
+    {
+      airgap =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = serverAddress;
+              prefixLength = 24;
+            }
+          ];
+          services.vwifi = {
+            server = {
+              enable = true;
+              ports.tcp = 8212;
+              ports.spy = 8213;
+              openFirewall = true;
+            };
+          };
+        };
+
+      ap =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 2;
+              prefixLength = 24;
+            }
+          ];
+          services.hostapd = {
+            enable = true;
+            radios.${wlanInterface} = {
+              channel = 1;
+              networks.${wlanInterface} = {
+                inherit ssid;
+                authentication = {
+                  mode = "wpa3-sae";
+                  saePasswords = [ { password = psk; } ];
+                  enableRecommendedPairwiseCiphers = true;
+                };
+              };
+            };
+          };
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:01";
+            };
+            client = {
+              enable = true;
+              inherit serverAddress;
+            };
+          };
+        };
+
+      station =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 3;
+              prefixLength = 24;
+            }
+          ];
+          networking.wireless = {
+            # No, really, we want it enabled!
+            enable = lib.mkOverride 0 true;
+            interfaces = [ wlanInterface ];
+            networks = {
+              ${ssid} = {
+                inherit psk;
+                authProtocols = [ "SAE" ];
+              };
+            };
+          };
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:02";
+            };
+            client = {
+              enable = true;
+              inherit serverAddress;
+            };
+          };
+        };
+
+      monitor =
+        { config, ... }:
+        {
+          networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+            {
+              address = hostAddress 4;
+              prefixLength = 24;
+            }
+          ];
+
+          services.kismet = {
+            enable = true;
+            serverName = "NixOS Kismet Smoke Test";
+            serverDescription = "Server testing virtual wifi devices running on Hydra";
+            httpd.enable = true;
+            # Check that the settings all eval correctly
+            settings = {
+              # Should append to log_types
+              log_types' = "wiglecsv";
+
+              # Should all generate correctly
+              wepkey = [
+                "00:DE:AD:C0:DE:00"
+                "FEEDFACE42"
+              ];
+              alert = [
+                [
+                  "ADHOCCONFLICT"
+                  "5/min"
+                  "1/sec"
+                ]
+                [
+                  "ADVCRYPTCHANGE"
+                  "5/min"
+                  "1/sec"
+                ]
+              ];
+              gps.gpsd = {
+                host = "localhost";
+                port = 2947;
+              };
+              apspoof.Foo1 = [
+                {
+                  ssid = "Bar1";
+                  validmacs = [
+                    "00:11:22:33:44:55"
+                    "aa:bb:cc:dd:ee:ff"
+                  ];
+                }
+                {
+                  ssid = "Bar2";
+                  validmacs = [
+                    "01:12:23:34:45:56"
+                    "ab:bc:cd:de:ef:f0"
+                  ];
+                }
+              ];
+              apspoof.Foo2 = [
+                {
+                  ssid = "Bar2";
+                  validmacs = [
+                    "00:11:22:33:44:55"
+                    "aa:bb:cc:dd:ee:ff"
+                  ];
+                }
+              ];
+
+              # The actual source
+              source.${wlanInterface} = {
+                name = "Virtual Wifi";
+              };
+            };
+            extraConfig = ''
+              # this comment should be ignored
+            '';
+          };
+
+          services.vwifi = {
+            module = {
+              enable = true;
+              macPrefix = "74:F8:F6:00:03";
+            };
+            client = {
+              enable = true;
+              spy = true;
+              inherit serverAddress;
+            };
+          };
+
+          environment.systemPackages = with pkgs; [
+            config.services.kismet.package
+            config.services.vwifi.package
+            jq
+          ];
+        };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import shlex
+
+      # Wait for the vwifi server to come up
+      airgap.start()
+      airgap.wait_for_unit("vwifi-server.service")
+      airgap.wait_for_open_port(${toString nodes.airgap.services.vwifi.server.ports.tcp})
+
+      httpd_port = ${toString nodes.monitor.services.kismet.httpd.port}
+      server_name = "${nodes.monitor.services.kismet.serverName}"
+      server_description = "${nodes.monitor.services.kismet.serverDescription}"
+      wlan_interface = "${wlanInterface}"
+      ap_essid = "${ssid}"
+      ap_mac_prefix = "${nodes.ap.services.vwifi.module.macPrefix}"
+      station_mac_prefix = "${nodes.station.services.vwifi.module.macPrefix}"
+
+      # Spawn the other nodes.
+      monitor.start()
+
+      # Wait for the monitor to come up
+      monitor.wait_for_unit("kismet.service")
+      monitor.wait_for_open_port(httpd_port)
+
+      # Should be up but require authentication.
+      url = f"http://localhost:{httpd_port}"
+      monitor.succeed(f"curl {url} | tee /dev/stderr | grep '<title>Kismet</title>'")
+
+      # Have to set the password now.
+      monitor.succeed("echo httpd_username=nixos >> ~kismet/.kismet/kismet_httpd.conf")
+      monitor.succeed("echo httpd_password=hydra >> ~kismet/.kismet/kismet_httpd.conf")
+      monitor.systemctl("restart kismet.service")
+      monitor.wait_for_unit("kismet.service")
+      monitor.wait_for_open_port(httpd_port)
+
+      # Authentication should now work.
+      url = f"http://nixos:hydra@localhost:{httpd_port}"
+      monitor.succeed(f"curl {url}/system/status.json | tee /dev/stderr | jq -e --arg serverName {shlex.quote(server_name)} --arg serverDescription {shlex.quote(server_description)} '.\"kismet.system.server_name\" == $serverName and .\"kismet.system.server_description\" == $serverDescription'")
+
+      # Wait for the station to connect to the AP while Kismet is monitoring
+      ap.start()
+      station.start()
+
+      unit = f"wpa_supplicant-{wlan_interface}"
+
+      # Generate handshakes until we detect both devices
+      success = False
+      for i in range(100):
+        station.wait_for_unit(f"wpa_supplicant-{wlan_interface}.service")
+        station.succeed(f"ifconfig {wlan_interface} down && ifconfig {wlan_interface} up")
+        station.wait_until_succeeds(f"journalctl -u {shlex.quote(unit)} -e | grep -Eqi {shlex.quote(wlan_interface + ': CTRL-EVENT-CONNECTED - Connection to ' + ap_mac_prefix + '[0-9a-f:]* completed')}")
+        station.succeed(f"journalctl --rotate --unit={shlex.quote(unit)}")
+        station.succeed(f"sleep 3 && journalctl --vacuum-time=1s --unit={shlex.quote(unit)}")
+
+        # We're connected, make sure Kismet sees both of our devices
+        status, stdout = monitor.execute(f"curl {url}/devices/views/all/last-time/0/devices.json | tee /dev/stderr | jq -e --arg macPrefix {shlex.quote(ap_mac_prefix)} --arg ssid {shlex.quote(ap_essid)} '. | (map(select((.\"kismet.device.base.macaddr\"? | startswith($macPrefix)) and .\"dot11.device\"?.\"dot11.device.last_beaconed_ssid_record\"?.\"dot11.advertisedssid.ssid\" == $ssid)) | length) == 1'")
+        if status != 0:
+          continue
+        status, stdout = monitor.execute(f"curl {url}/devices/views/all/last-time/0/devices.json | tee /dev/stderr | jq -e --arg macPrefix {shlex.quote(station_mac_prefix)} '. | (map(select((.\"kismet.device.base.macaddr\"? | startswith($macPrefix)))) | length) == 1'")
+        if status == 0:
+          success = True
+          break
+
+      assert success
+    '';
+}

nixos/tests/mattermost/default.nix

@@ -335,9 +335,23 @@ import ../make-test-python.nix (
             if [ "$actualPostAttachmentHash" != "$postAttachmentHash" ]; then
               echo "Post attachment hash mismatched!" >&2
               exit 1
-            else
+            fi
+
+            # Make sure it's on the filesystem in the expected place
+            fsPath="$(find /var/lib/mattermost/data -name "$(basename -- "$postAttachment")" -print -quit)"
+            if [ -z "$fsPath" ] || [ ! -f "$fsPath" ]; then
+              echo "Attachment didn't exist on the filesystem!" >&2
+              exit 1
+            fi
+
+            # And that the hash matches.
+            actualFsAttachmentHash="$(sha256sum "$fsPath" | awk '{print $1}')"
+            if [ "$actualFsAttachmentHash" == "$postAttachmentHash" ]; then
               echo "Post attachment hash was OK!" >&2
               exit 0
+            else
+              echo "Attachment hash mismatched on disk!" >&2
+              exit 1
             fi
           else
             echo "Post didn't exist when it should have!" >&2
@@ -454,11 +468,9 @@ import ../make-test-python.nix (
           # Switch to the newer config and make sure the plugins directory is replaced with a directory,
           # since it could have been a symlink on previous versions.
           mostlyMutable.systemctl("stop mattermost.service")
-          mostlyMutable.succeed(f"[ ! -L /var/lib/mattermost/data/plugins ] && rm -rf /var/lib/mattermost/data/plugins && ln -s {mostlyMutablePlugins} /var/lib/mattermost/data/plugins || true")
           mostlyMutable.succeed('[ -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
           switch_to_specialisation(mostlyMutable, mostlyMutableToplevel, "upgrade")
           wait_mattermost_up(mostlyMutable)
-          mostlyMutable.succeed('[ ! -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
 
           # HelpLink should be changed, still, and the post should still exist
           expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')

pkgs/applications/audio/puredata/default.nix

@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/pd --prefix PATH : ${lib.makeBinPath [ tk ]}
+    wrapProgram $out/bin/pd-gui --prefix PATH : ${lib.makeBinPath [ tk ]}
   '';
 
   meta = with lib; {

pkgs/applications/misc/goldendict-ng/default.nix

@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation {
   pname = "goldendict-ng";
-  version = "25.02.0";
+  version = "25.05.0";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    tag = "v25.02.0-Release.e895b18c";
-    hash = "sha256-k8pGzrSFbAUP7DG3lSAYBa5WeeSUbjZMvMqmxPqdT3E=";
+    tag = "v25.05.0-Release.2a2b0e16";
+    hash = "sha256-PBqkVac867xE4ZcvwTysAK6rQSoEZelKrV9USvFsaLk=";
   };
 
   nativeBuildInputs = [
@@ -92,6 +92,7 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [
       slbtty
       michojel
+      linsui
     ];
     license = licenses.gpl3Plus;
   };

pkgs/applications/networking/charles/default.nix

@@ -4,6 +4,7 @@
   makeWrapper,
   makeDesktopItem,
   fetchurl,
+  openjdk17-bootstrap,
   jdk11,
   jdk8,
 }:
@@ -12,7 +13,7 @@ let
   generic =
     {
       version,
-      sha256,
+      hash,
       platform ? "",
       jdk,
       ...
@@ -52,13 +53,16 @@ let
           "--user-agent"
           "Mozilla/5.0"
         ]; # HTTP 104 otherwise
-        inherit sha256;
+        inherit hash;
       };
+
       nativeBuildInputs = [ makeWrapper ];
 
       installPhase = ''
+        runHook preInstall
+
         makeWrapper ${jdk}/bin/java $out/bin/charles \
-          --add-flags "-Xmx1024M -Dcharles.config='~/.charles.config' -jar $out/share/java/charles.jar"
+          --add-flags "-Xmx1024M -Dcharles.config='~/.charles.config' ${lib.optionalString (lib.versionOlder version "5.0") "-jar $out/share/java/charles.jar"} ${lib.optionalString (lib.versionAtLeast version "5.0") "-XX:+UseZGC -Djava.library.path='$out/share/java' --add-opens java.base/sun.security.ssl=com.charlesproxy --add-opens java.desktop/java.awt.event=com.charlesproxy --add-opens java.base/java.io=com.charlesproxy --add-modules com.jthemedetector,com.formdev.flatlaf --module-path '$out/share/java' -m com.charlesproxy"}"
 
         for fn in lib/*.jar; do
           install -D -m644 $fn $out/share/java/$(basename $fn)
@@ -69,27 +73,37 @@ let
 
         mkdir -p $out/share/icons
         cp -r icon $out/share/icons/hicolor
+
+        runHook postInstall
       '';
 
-      meta = with lib; {
+      meta = {
         description = "Web Debugging Proxy";
         homepage = "https://www.charlesproxy.com/";
-        maintainers = with maintainers; [
+        maintainers = with lib.maintainers; [
           kalbasit
           kashw2
         ];
-        sourceProvenance = with sourceTypes; [ binaryBytecode ];
-        license = licenses.unfree;
-        platforms = platforms.unix;
+        sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+        license = lib.licenses.unfree;
+        platforms = lib.platforms.unix;
       };
     };
 
 in
 {
+  charles5 = (
+    generic {
+      version = "5.0";
+      hash = "sha256-gvspRI3uF7bjE4UBuTGS5+n2h0nKudLtW3sqs2GZIyM=";
+      platform = "_x86_64";
+      jdk = openjdk17-bootstrap;
+    }
+  );
   charles4 = (
     generic {
-      version = "4.6.4";
-      sha256 = "KEQYb90kt41dS3TJLZqdaV9P3mQA9UPsEyiFb/knm3w=";
+      version = "4.6.8";
+      hash = "sha256-AaS+zmQTWsGoLEhyGHA/UojmctE7IV0N9fnygNhEPls=";
       platform = "_amd64";
       jdk = jdk11;
     }
@@ -97,7 +111,7 @@ in
   charles3 = (
     generic {
       version = "3.12.3";
-      sha256 = "13zk82ny1w5zd9qcs9qkq0kdb22ni5byzajyshpxdfm4zv6p32ss";
+      hash = "sha256-Wotxzf6kutYv1F6q71eJVojVJsATJ81war/w4K1A848=";
       jdk = jdk8.jre;
       mainProgram = "charles";
     }

pkgs/applications/networking/mailreaders/notmuch/default.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "notmuch";
-  version = "0.38.3";
+  version = "0.39";
 
   src = fetchurl {
     url = "https://notmuchmail.org/releases/notmuch-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mvRsyA2li0MByiuu/MJaQNES0DFVB+YywPPw8IMo0FQ=";
+    hash = "sha256-uIuwKnbEa62NMT/Su0+OOSmLUfZvy+swTZ+Aw+73BOM=";
   };
 
   nativeBuildInputs =
@@ -68,14 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withRuby ruby
     ++ lib.optional withSfsexp sfsexp;
 
-  patches = [
-    (fetchpatch {
-      name = "add-workaround-for-Emacs-30-pp-changes.patch";
-      url = "https://git.notmuchmail.org/git?p=notmuch;a=patch;h=e3d4721b1ba4836c7646e057b50123fe994652eb";
-      hash = "sha256-phfNSOlTajTmaf+DjtdmBAWSm+2tUbrQEChInUlwn5k=";
-    })
-  ];
-
   postPatch =
     ''
       patchShebangs configure test/
@@ -142,10 +134,9 @@ stdenv.mkDerivation (finalAttrs: {
       ln -s ${test-database} test/test-databases/database-v1.tar.xz
     ''
     + ''
-      # Issues since gnupg: 2.4.0 -> 2.4.1
-      rm test/{T350-crypto,T357-index-decryption}.sh
       # Issues since pbr 6.0.0 bump (ModuleNotFoundError: No module named 'notmuch2')
       rm test/T055-path-config.sh
+      rm test/T610-message-property.sh
       # Flaky, seems to get its paths wrong sometimes (?)
       # *ERROR*: Opening output file: Permission denied, /nix/store/bzy21v2cd5sq1djzwa9b19q08wpp9mm0-emacs-29.1/bin/OUTPUT
       rm test/T460-emacs-tree.sh
@@ -209,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
   passthru = {
-    pythonSourceRoot = "notmuch-${finalAttrs.version}/bindings/python";
+    pythonSourceRoot = "notmuch-${finalAttrs.version}/contrib/python-legacy";
     gemEnv = buildEnv {
       name = "notmuch-vim-gems";
       paths = with ruby.gems; [ mail ];

pkgs/applications/office/libreoffice/default.nix

@@ -10,7 +10,7 @@
   libxslt,
   perl,
   perlPackages,
-  box2d,
+  box2d_2,
   gettext,
   zlib,
   libjpeg,
@@ -397,7 +397,7 @@ stdenv.mkDerivation (finalAttrs: {
       ant
       bluez5
       boost
-      box2d
+      box2d_2
       cairo
       clucene_core_2
       cppunit

pkgs/applications/science/math/mathematica/versions.nix

@@ -8,6 +8,20 @@
 
 let
   versions = [
+    {
+      version = "14.2.1";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-WNLuq9RviYF3Mj8uOALhmvcxGGHVq/TAGFMTGWoYBcc=";
+      installer = "Wolfram_14.2.1_LIN.sh";
+    }
+    {
+      version = "14.2.1";
+      lang = "en";
+      language = "English";
+      sha256 = "sha256-DcZbetr5wO3i/DkchgpsW3RGHfa1PslA4fK+bRQ68Bg=";
+      installer = "Wolfram_14.2.1_LIN_Bndl.sh";
+    }
     {
       version = "14.2.0";
       lang = "en";

pkgs/applications/science/misc/openrefine/default.nix

@@ -11,12 +11,12 @@
 }:
 
 let
-  version = "3.9.2";
+  version = "3.9.3";
   src = fetchFromGitHub {
     owner = "openrefine";
     repo = "openrefine";
     rev = version;
-    hash = "sha256-Z52YfS+caNe7N3xMv85eoBes6TwkSsGk5/rGaQd/6ds=";
+    hash = "sha256-wV5ur31JEGcMSLRHQq/H6GlsdpEzTH6ZxBkE9Sj6TkU=";
   };
 
   npmPkg = buildNpmPackage {

pkgs/by-name/ao/aonsoku/package.nix

@@ -8,7 +8,6 @@
   pkg-config,
   wrapGAppsHook3,
   openssl,
-  libsoup_2_4,
   webkitgtk_4_1,
   glib-networking,
   nix-update-script,
@@ -48,7 +47,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [
     openssl
-    libsoup_2_4
     webkitgtk_4_1
     glib-networking
   ];

pkgs/by-name/ap/apt/package.nix

@@ -34,14 +34,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.9.35";
+  version = "3.0.0";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "apt-team";
     repo = "apt";
     rev = finalAttrs.version;
-    hash = "sha256-B4rFOt4J94/XkFw09sdvfogdY1b5R6QYnNC3HVUV9pc=";
+    hash = "sha256-0jtJ/y8TK/mJeTM5n1WblT9i5OtRg6r5C7kvB+ioMz0=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/au/authentik/package.nix

@@ -278,7 +278,7 @@ let
             pyyaml
             requests-oauthlib
             scim2-filter-parser
-            sentry-sdk_2
+            sentry-sdk
             service-identity
             setproctitle
             structlog

pkgs/by-name/ba/base16-schemes/package.nix

@@ -4,16 +4,15 @@
   fetchFromGitHub,
   ...
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "base16-schemes";
-  version = "unstable-2024-11-12";
+  version = "unstable-2025-04-18";
 
   src = fetchFromGitHub {
     owner = "tinted-theming";
     repo = "schemes";
-    rev = "61058a8d2e2bd4482b53d57a68feb56cdb991f0b";
-    sha256 = "sha256-Tp1BpaF5qRav7O2TsSGjCfgRzhiasu4IuwROR66gz1o=";
+    rev = "28c26a621123ad4ebd5bbfb34ab39421c0144bdd";
+    hash = "sha256-Fg+rdGs5FAgfkYNCs74lnl8vkQmiZVdBsziyPhVqrlY=";
   };
 
   installPhase = ''

pkgs/by-name/ba/bazel-watcher/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "bazel-watcher";
-  version = "0.25.3";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
     rev = "v${version}";
-    hash = "sha256-5cRj04e5VVG4NSe4LOLkZIrerT4laLEDeXCqTiJj6MM=";
+    hash = "sha256-FPyOdKJ8HSerFHDIjUkHKXMgoLmVeuyHYmo0v/8C0do=";
   };
 
-  vendorHash = "sha256-0I/bvuyosN55oNSMuom4C8rVjxneUaqV19l9OMiwWhU=";
+  vendorHash = "sha256-H1Bqw5hbOLS4oJeQOdIXQ9c2H8jGtoW1J75BIkTNR9k=";
 
   # The dependency github.com/fsnotify/fsevents requires CGO
   env.CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";

pkgs/by-name/bo/borgbackup/package.nix

@@ -20,14 +20,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "borgbackup";
     repo = "borg";
     tag = version;
-    hash = "sha256-n1hCM7Sp0t2bOJEzErEd1PS/Xc7c+KDmJ4PjQuuF140=";
+    hash = "sha256-1RRizsHY6q1ruofTkRZ4sSN4k6Hoo+sG85w2zz+7yL8=";
   };
 
   postPatch = ''
@@ -45,6 +45,7 @@ python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python.pkgs; [
     # docs
     sphinxHook
+    sphinxcontrib-jquery
     guzzle-sphinx-theme
 
     # shell completions
@@ -78,6 +79,13 @@ python.pkgs.buildPythonApplication rec {
     ''--prefix PATH ':' "${openssh}/bin"''
   ];
 
+  preInstallSphinx = ''
+    # remove invalid outputs for manpages
+    rm .sphinx/man/man/_static/jquery.js
+    rm .sphinx/man/man/_static/_sphinx_javascript_frameworks_compat.js
+    rmdir .sphinx/man/man/_static/
+  '';
+
   postInstall = ''
     installShellCompletion --cmd borg \
       --bash scripts/shell_completions/bash/borg \

pkgs/by-name/bo/box2d/cmake_dont_fetch_enkits.patch

@@ -0,0 +1,16 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 8c1390e..791d3b7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -83,10 +83,7 @@ if(PROJECT_IS_TOP_LEVEL)
+ 		# Used in tests and samples
+ 		FetchContent_Declare(
+ 			enkits
+-			GIT_REPOSITORY https://github.com/dougbinks/enkiTS.git
+-			GIT_TAG master
+-			GIT_SHALLOW TRUE
+-			GIT_PROGRESS TRUE
++			URL @enkits_src@
+ 		)
+ 		FetchContent_MakeAvailable(enkits)
+ 	endif()

pkgs/by-name/bo/box2d/cmake_use_system_glfw_and_imgui.patch

@@ -0,0 +1,54 @@
+diff --git a/samples/CMakeLists.txt b/samples/CMakeLists.txt
+index 5020345..97af8c6 100644
+--- a/samples/CMakeLists.txt
++++ b/samples/CMakeLists.txt
+@@ -17,47 +17,12 @@ set(GLFW_BUILD_EXAMPLES OFF CACHE BOOL "GLFW Examples")
+ set(GLFW_BUILD_TESTS OFF CACHE BOOL "GLFW Tests")
+ set(GLFW_INSTALL OFF CACHE BOOL "GLFW Install")
+ 
+-FetchContent_Declare(
+-	glfw
+-	GIT_REPOSITORY https://github.com/glfw/glfw.git
+-	GIT_TAG 3.4
+-	GIT_SHALLOW TRUE
+-	GIT_PROGRESS TRUE
+-)
+-FetchContent_MakeAvailable(glfw)
++find_package(glfw)
+ 
+ # imgui and glfw backend for GUI
+ # https://gist.github.com/jeffamstutz/992723dfabac4e3ffff265eb71a24cd9
+ # Modified to pin to a specific imgui release
+-FetchContent_Populate(imgui
+-	URL https://github.com/ocornut/imgui/archive/refs/tags/v1.91.3.zip
+-	SOURCE_DIR ${CMAKE_SOURCE_DIR}/build/imgui
+-)
+-
+-set(IMGUI_DIR ${CMAKE_SOURCE_DIR}/build/imgui)
+-
+-add_library(imgui STATIC
+-	${IMGUI_DIR}/imconfig.h
+-	${IMGUI_DIR}/imgui.h
+-
+-	${IMGUI_DIR}/imgui.cpp
+-	${IMGUI_DIR}/imgui_draw.cpp
+-	${IMGUI_DIR}/imgui_demo.cpp
+-	${IMGUI_DIR}/imgui_tables.cpp
+-	${IMGUI_DIR}/imgui_widgets.cpp
+-
+-	${IMGUI_DIR}/backends/imgui_impl_glfw.cpp
+-	${IMGUI_DIR}/backends/imgui_impl_opengl3.cpp
+-)
+-
+-target_link_libraries(imgui PUBLIC glfw glad)
+-target_include_directories(imgui PUBLIC ${IMGUI_DIR} ${IMGUI_DIR}/backends)
+-target_compile_definitions(imgui PUBLIC IMGUI_DISABLE_OBSOLETE_FUNCTIONS)
+-set_target_properties(imgui PROPERTIES
+-	CXX_STANDARD 20
+-    CXX_STANDARD_REQUIRED YES
+-    CXX_EXTENSIONS NO
+-)
++find_package(imgui)
+ 
+ # jsmn for json
+ set(JSMN_DIR ${CMAKE_SOURCE_DIR}/extern/jsmn)

pkgs/by-name/bo/box2d/package.nix

@@ -0,0 +1,101 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  substituteAll,
+
+  # nativeBuildInputs
+  cmake,
+  pkg-config,
+
+  # buildInputs
+  glfw3,
+  imgui,
+  libGLU,
+  libX11,
+  libXcursor,
+  libXi,
+  libXinerama,
+  libXrandr,
+  libglut,
+  xorgproto,
+
+  nix-update-script,
+}:
+
+let
+  inherit (lib) cmakeBool;
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "box2d";
+  version = "3.1.0";
+
+  src = fetchFromGitHub {
+    owner = "erincatto";
+    repo = "box2d";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QTSU1+9x8GoUK3hlTDMh43fc4vbNfFR7syt6xVHIuPs=";
+  };
+
+  patches = [
+    # prevent CMake from trying to download some libraries from the internet
+    (substituteAll {
+      src = ./cmake_dont_fetch_enkits.patch;
+      enkits_src = fetchFromGitHub {
+        owner = "dougbinks";
+        repo = "enkiTS";
+        rev = "686d0ec31829e0d9e5edf9ceb68c40f9b9b20ea9";
+        hash = "sha256-CerLj/WY+J3mrMvv7dGmZltjAM9v5C/IY4X+Ph78HVs=";
+      };
+    })
+    ./cmake_use_system_glfw_and_imgui.patch
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isGNU [
+      # error: '*(float *)((char *)&localPointA + offsetof(b2Vec2, y))' may be used uninitialized
+      "-Wno-error=maybe-uninitialized"
+    ]
+  );
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    glfw3
+    (imgui.override {
+      # GLFW backend is disabled by default on darwin but box2d imports it unconditionally
+      # https://github.com/erincatto/box2d/blob/v3.1.0/samples/main.cpp#L28
+      IMGUI_BUILD_GLFW_BINDING = true;
+    })
+    libGLU
+    libX11
+    libXcursor
+    libXi
+    libXinerama
+    libXrandr
+    libglut
+    xorgproto
+  ];
+
+  cmakeFlags = [
+    (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "2D physics engine";
+    homepage = "https://box2d.org/";
+    changelog = "https://github.com/erincatto/box2d/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.zlib;
+  };
+})

pkgs/by-name/bo/box2d_2/package.nix

@@ -2,22 +2,27 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   cmake,
+  pkg-config,
+
+  # buildInputs
+  glfw3,
   libGLU,
-  libGL,
-  libglut,
   libX11,
   libXcursor,
+  libXi,
   libXinerama,
   libXrandr,
+  libglut,
   xorgproto,
-  libXi,
-  pkg-config,
-  settingsFile ? "include/box2d/b2_settings.h",
+
+  nix-update-script,
 }:
 
 let
-  inherit (lib) cmakeBool optionals;
+  inherit (lib) cmakeBool;
 
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -27,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "erincatto";
     repo = "box2d";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-yvhpgiZpjTPeSY7Ma1bh4LwIokUUKB10v2WHlamL9D8=";
   };
 
@@ -37,34 +42,27 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    glfw3
     libGLU
-    libGL
-    libglut
     libX11
     libXcursor
+    libXi
     libXinerama
     libXrandr
+    libglut
     xorgproto
-    libXi
   ];
 
   cmakeFlags = [
     (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
-  prePatch = ''
-    substituteInPlace ${settingsFile}  \
-      --replace-fail 'b2_maxPolygonVertices	8' 'b2_maxPolygonVertices	15'
-  '';
-
-  # tests are broken on 2.4.2 and 2.3.x doesn't have tests: https://github.com/erincatto/box2d/issues/677
-  doCheck = lib.versionAtLeast finalAttrs.version "2.4.2";
-
-  meta = with lib; {
+  meta = {
     description = "2D physics engine";
     homepage = "https://box2d.org/";
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.unix;
-    license = licenses.zlib;
+    changelog = "https://github.com/erincatto/box2d/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.zlib;
   };
 })

pkgs/by-name/ca/catppuccin/package.nix

@@ -1,5 +1,6 @@
 let
   validThemes = [
+    "alacritty"
     "bat"
     "bottom"
     "btop"
@@ -55,6 +56,14 @@ let
 
   selectedSources = map (themeName: builtins.getAttr themeName sources) themeList;
   sources = {
+    alacritty = fetchFromGitHub {
+      name = "alacritty";
+      owner = "catppuccin";
+      repo = "alacritty";
+      rev = "f6cb5a5c2b404cdaceaff193b9c52317f62c62f7";
+      hash = "sha256-H8bouVCS46h0DgQ+oYY8JitahQDj0V9p2cOoD4cQX+Q=";
+    };
+
     bat = fetchFromGitHub {
       name = "bat";
       owner = "catppuccin";
@@ -222,6 +231,11 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
         local capitalizedVariant=$(sed 's/^\(.\)/\U\1/' <<< "${variant}")
         local capitalizedAccent=$(sed 's/^\(.\)/\U\1/' <<< "${accent}")
 
+      ''
+      + lib.optionalString (lib.elem "alacritty" themeList) ''
+        mkdir -p "$out/alacritty"
+        cp "${sources.alacritty}/catppuccin-${variant}.toml" "$out/alacritty/"
+
       ''
       + lib.optionalString (lib.elem "bat" themeList) ''
         mkdir -p "$out/bat"

pkgs/by-name/ch/chatbox/package.nix

@@ -2,14 +2,15 @@
   lib,
   appimageTools,
   fetchurl,
+  writeScript,
 }:
 let
   pname = "chatbox";
-  version = "1.11.3";
+  version = "1.11.12";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-YMZsgbCkG/cZd77DOVZj6jVJDzWMcrt92soxyLNr2QI=";
+    hash = "sha256-sfR4fXpREPdEoPoez5ugCpn/ubpB6EhkvpVq6rz0BSg=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
@@ -25,7 +26,7 @@ appimageTools.wrapType2 {
       --replace-fail 'Icon=xyz.chatboxapp.app' 'Icon=chatbox'
   '';
 
-  passthru.updateScript = ''
+  passthru.updateScript = writeScript "update-chatbox" ''
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl gnugrep common-updater-scripts
     version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')

pkgs/by-name/cl/clapper-enhancers/package.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gobject-introspection,
+  libpeas2,
+  json-glib,
+  libsoup_3,
+  glib,
+  clapper-unwrapped,
+  gst_all_1,
+  python3Packages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clapper-enhancers";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "Rafostar";
+    repo = "clapper-enhancers";
+    tag = finalAttrs.version;
+    hash = "sha256-CUfTz+YvliJXiv/nsdrpDVFSblqoSW7js8vAtJ9u5vM=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    python3Packages.python
+    python3Packages.wrapPython
+  ];
+
+  buildInputs = [
+    libpeas2
+    json-glib
+    libsoup_3
+    glib
+    clapper-unwrapped
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+  ];
+
+  pythonPath = with python3Packages; [
+    yt-dlp
+  ];
+
+  postFixup = ''
+    buildPythonPath "$out $pythonPath"
+    for yt_plugin in $out/lib/clapper-enhancers/plugins/yt-dlp/*.py; do
+      patchPythonScript $yt_plugin
+    done
+  '';
+
+  mesonFlags = [ "-Denhancersdir=${placeholder "out"}/${finalAttrs.passthru.pluginPath}" ];
+
+  passthru.pluginPath = "lib/clapper-enhancers/plugins";
+
+  meta = {
+    description = "Plugins enhancing Clapper library capabilities";
+    homepage = "https://github.com/Rafostar/clapper-enhancers";
+    license = lib.licenses.lgpl21Only;
+    inherit (clapper-unwrapped.meta) maintainers platforms;
+  };
+})

pkgs/by-name/cl/clapper-unwrapped/package.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gobject-introspection,
+  pkg-config,
+  ninja,
+  desktop-file-utils,
+  shared-mime-info,
+  meson,
+  gtk4,
+  gst_all_1,
+  libGL,
+  libadwaita,
+  libsoup_3,
+  vala,
+  cmake,
+  libmicrodns,
+  glib-networking,
+  libpeas2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "clapper-unwrapped";
+  version = "0.8.0";
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "Rafostar";
+    repo = "clapper";
+    tag = finalAttrs.version;
+    hash = "sha256-Yb2fWsdd8jhxkGWKanLn7CAuF4MjyQ27XTrO8ja3hfs=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    meson
+    cmake
+    ninja
+    pkg-config
+    desktop-file-utils # for update-desktop-database
+    shared-mime-info # for update-mime-database
+    vala
+  ];
+
+  buildInputs = [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+    glib-networking # for TLS support
+    gtk4
+    libGL
+    libadwaita
+    libsoup_3
+    libmicrodns
+    libpeas2
+  ];
+
+  postPatch = ''
+    patchShebangs --build build-aux/meson/postinstall.py
+  '';
+
+  preFixup = ''
+    mkdir -p $out/share/gsettings-schemas
+    cp -r $lib/share/gsettings-schemas/clapper-unwrapped-$version $out/share/gsettings-schemas/clapper-$version
+  '';
+
+  meta = {
+    description = "GNOME media player built using GTK4 toolkit and powered by GStreamer with OpenGL rendering";
+    longDescription = ''
+      Clapper is a GNOME media player built using the GTK4 toolkit.
+      The media player is using GStreamer as a media backend.
+    '';
+    homepage = "https://github.com/Rafostar/clapper";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/cl/clapper/package.nix

@@ -1,88 +1,41 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  gobject-introspection,
-  pkg-config,
-  ninja,
-  desktop-file-utils,
-  makeWrapper,
-  shared-mime-info,
+  stdenvNoCC,
+  clapper-unwrapped,
   wrapGAppsHook4,
-  meson,
-  gtk4,
-  gst_all_1,
-  libGL,
-  libadwaita,
-  libsoup_3,
-  vala,
-  cmake,
-  libmicrodns,
-  gtuber,
-  glib-networking,
-  libpeas2,
+  gobject-introspection,
+  xorg,
+  clapper-enhancers,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation {
   pname = "clapper";
-  version = "0.8.0";
+  inherit (clapper-unwrapped) version meta;
 
-  src = fetchFromGitHub {
-    owner = "Rafostar";
-    repo = "clapper";
-    tag = finalAttrs.version;
-    hash = "sha256-Yb2fWsdd8jhxkGWKanLn7CAuF4MjyQ27XTrO8ja3hfs=";
-  };
+  src = clapper-unwrapped;
+
+  dontConfigure = true;
+  dontBuild = true;
 
   nativeBuildInputs = [
+    wrapGAppsHook4
     gobject-introspection
-    meson
-    cmake
-    ninja
-    makeWrapper
-    pkg-config
-    wrapGAppsHook4 # for gsettings
-    desktop-file-utils # for update-desktop-database
-    shared-mime-info # for update-mime-database
-    vala
+    xorg.lndir
   ];
 
-  buildInputs = [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-ugly
-    gtuber
-    glib-networking # for TLS support
-    gtk4
-    libGL
-    libadwaita
-    libsoup_3
-    libmicrodns
-    libpeas2
-  ];
+  buildInputs = [ clapper-unwrapped ] ++ clapper-unwrapped.buildInputs;
 
-  postPatch = ''
-    patchShebangs --build build-aux/meson/postinstall.py
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    lndir $src $out
+
+    runHook postInstall
   '';
 
-  # The package uses "clappersink" provided by itself
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : $out/lib/gstreamer-1.0
+      --set-default CLAPPER_ENHANCERS_PATH "${clapper-enhancers}/${clapper-enhancers.passthru.pluginPath}"
     )
   '';
-
-  meta = {
-    description = "GNOME media player built using GTK4 toolkit and powered by GStreamer with OpenGL rendering";
-    longDescription = ''
-      Clapper is a GNOME media player built using the GTK4 toolkit.
-      The media player is using GStreamer as a media backend.
-    '';
-    homepage = "https://github.com/Rafostar/clapper";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ aleksana ];
-    platforms = lib.platforms.linux;
-  };
-})
+}

pkgs/by-name/co/copier/package.nix

@@ -7,7 +7,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "copier";
-  version = "9.4.1";
+  version = "9.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
     postFetch = ''
       rm $out/tests/demo/doc/ma*ana.txt
     '';
-    hash = "sha256-bNz3xFYksgdN9iXbkZIHWsHpRa9aICxBZmzy/t0+3z0=";
+    hash = "sha256-mezmXrOvfqbZGZadNZklQZt/OEKqRYnwugNkZc88t6o=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;
@@ -49,16 +49,14 @@ python3.pkgs.buildPythonApplication rec {
     questionary
   ];
 
-  makeWrapperArgs = [
-    "--suffix PATH : ${lib.makeBinPath [ git ]}"
-  ];
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ git ]}" ];
 
-  meta = with lib; {
+  meta = {
     description = "Library and command-line utility for rendering projects templates";
     homepage = "https://copier.readthedocs.io";
     changelog = "https://github.com/copier-org/copier/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ greg ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ greg ];
     mainProgram = "copier";
   };
 }

pkgs/by-name/ed/eduli/package.nix

@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchzip {
     name = "${pname}-${version}";
     url = "https://language.moe.gov.tw/001/Upload/Files/site_content/M0001/MoeLI-3.0.zip";
-    hash = "sha256-/X5jPtjOvJTUbiKV5r2dWIFL5ft0iemdwj+Zt+Q13OA=";
+    hash = "sha256-bDQtLugYPWwJJNusBLEJrgIVufocRK4NIR0CCGaTkyw=";
   };
 
   installPhase = ''

pkgs/by-name/ex/excalidraw_export/bump-nan.patch

@@ -0,0 +1,18 @@
+diff --git a/package-lock.json b/package-lock.json
+index 89dd54f..2f364e4 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -805,9 +805,10 @@
+       "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
+     },
+     "node_modules/nan": {
+-      "version": "2.18.0",
+-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz",
+-      "integrity": "sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w=="
++      "version": "2.22.0",
++      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.0.tgz",
++      "integrity": "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==",
++      "license": "MIT"
+     },
+     "node_modules/node-fetch": {
+       "version": "2.7.0",

pkgs/by-name/ex/excalidraw_export/package.nix

@@ -5,7 +5,6 @@
   cairo,
   pango,
   pkg-config,
-  stdenv,
 }:
 
 buildNpmPackage {
@@ -19,7 +18,13 @@ buildNpmPackage {
     hash = "sha256-E5kYI8+hzObd2WNVBd0aQDKMH1Sns539loCQfClJs1Q=";
   };
 
-  npmDepsHash = "sha256-5yec7BCi1c/e+y00TqxIeoazs49+WdKdfsskAqnVkFs=";
+  patches = [
+    # for compatibility with nodejs_22
+    # generated by running: `npm update nan`
+    ./bump-nan.patch
+  ];
+
+  npmDepsHash = "sha256-bU+q83Pmw6+mCF5rTR0DyYstUYVN+YxH9T9H7ZA15so=";
 
   npmBuildScript = "compile";
 
@@ -35,6 +40,5 @@ buildNpmPackage {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ venikx ];
     mainProgram = "excalidraw_export";
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ex/exportarr/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "exportarr";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "onedr0p";
     repo = "exportarr";
     rev = "v${version}";
-    hash = "sha256-iNcdD2zigBZ2phtCkHRV0GZPrEjopV0K+vin1Zkb3Oo=";
+    hash = "sha256-8EHFnqQ3h9/X2lR+9UuuJeSPMonuVQVDYiMDoroDajs=";
   };
 
-  vendorHash = "sha256-F5WOSsjeOzMaj4Yze11OnqpgL1l87wpgl3OQEGya//M=";
+  vendorHash = "sha256-yzzhlhrfzj+qlG4wY+qGM0/sTUUlVQAgwiKNUEIVN0g=";
 
   subPackages = [ "cmd/exportarr" ];
 

pkgs/by-name/fi/fim/native-tools.patch

@@ -0,0 +1,26 @@
+diff --git a/doc/Makefile.in b/doc/Makefile.in
+index be8ebe5..13ae676 100644
+--- a/doc/Makefile.in
++++ b/doc/Makefile.in
+@@ -684,7 +684,7 @@ fimgs.man.html: fimgs.man
+ 	if test ! -s $@ ; then $(MAN2TXT) ./$< > $<.txt && $(srcdir)/vim2html.pl tags $<.txt && mv $<.txt.html $@ ; fi
+ 
+ doctags$(EXEEXT): doctags.c
+-	        $(CC) -o $@ $<
++	        @cc_for_build@ -o $@ $<
+ 
+ #clean:
+ #	        $(RM) -f  doctags.o doctags$(EXEEXT) FIM.html tags fim-stylesheet.css fim.man.html fimgs.man.html
+diff --git a/src/Makefile.in b/src/Makefile.in
+index 76f5e1e..027159c 100644
+--- a/src/Makefile.in
++++ b/src/Makefile.in
+@@ -1132,7 +1132,7 @@ help-acm.cpp: fim.h
+ 	$(ECHO) '//#endif' >> $@
+ 
+ b2ba$(EXEEXT): b2ba.c
+-	$(CC) -o $@ $<
++	@cc_for_build@ -o $@ $<
+ 
+ @FIM_WANT_CUSTOM_HARDCODED_CONSOLEFONT_TRUE@@HAVE_RUNNABLE_TESTS_TRUE@default_font_byte_array.h: $(FIM_CUSTOM_HARDCODED_CONSOLEFONT) b2ba$(EXEEXT)
+ @FIM_WANT_CUSTOM_HARDCODED_CONSOLEFONT_TRUE@@HAVE_RUNNABLE_TESTS_TRUE@	./b2ba$(EXEEXT) < $< > $@

pkgs/by-name/fi/fim/package.nix

@@ -4,13 +4,17 @@
   autoconf,
   automake,
   pkg-config,
+  substituteAll,
   lib,
   perl,
   flex,
   bison,
   readline,
   libexif,
-  x11Support ? true,
+  bash,
+  buildPackages,
+  # SDL depends on Qt, which doesn't cross-compile
+  x11Support ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform),
   SDL,
   svgSupport ? true,
   inkscape,
@@ -35,24 +39,33 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/p7bjeZM46DJOQ9sgtebhkNpBPj2RJYY3dMXhzHnNmg=";
   };
 
+  patches = [
+    # build tools with a build compiler
+    (substituteAll {
+      src = ./native-tools.patch;
+      cc_for_build = lib.getExe buildPackages.stdenv.cc;
+    })
+  ];
+
   postPatch = ''
-    substituteInPlace doc/vim2html.pl \
-      --replace /usr/bin/perl ${perl}/bin/perl
+    patchShebangs --build doc/vim2html.pl
   '';
 
   nativeBuildInputs = [
     autoconf
     automake
+    bison
+    flex
+    perl
     pkg-config
   ];
 
   buildInputs =
     [
-      perl
       flex
-      bison
       readline
       libexif
+      bash
     ]
     ++ lib.optional x11Support SDL
     ++ lib.optional svgSupport inkscape
@@ -62,6 +75,15 @@ stdenv.mkDerivation rec {
     ++ lib.optional jpegSupport libjpeg
     ++ lib.optional pngSupport libpng;
 
+  configureFlags = [
+    # mmap works on all relevant platforms
+    "ac_cv_func_mmap_fixed_mapped=yes"
+    # system regexp works on all relevant platforms
+    "fim_cv_regex_broken=no"
+  ];
+
+  env.LIBAA_CONFIG = lib.getExe' (lib.getDev aalib) "aalib-config";
+  env.LIBPNG_CONFIG = lib.getExe' (lib.getDev libpng) "libpng-config";
   env.NIX_CFLAGS_COMPILE = lib.optionalString x11Support "-lSDL";
 
   meta = with lib; {

pkgs/by-name/fq/fq/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "fq";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "fq";
     rev = "v${version}";
-    hash = "sha256-I3mVAPNWjRHG0td1ulzGOthiNybfWLx1HgwPjFfBHCo=";
+    hash = "sha256-/yRTeWyHVZZzWbkI/VhYD/T5KZq8E2j678LE8gn5ILE=";
   };
 
-  vendorHash = "sha256-p2cvv983gYTvyLPYIGVsk6N7yUzBpiPzgJ3sMRNWPTo=";
+  vendorHash = "sha256-vp7JQSnzijCkWximw4E2abd39l0qjIGkl+mPfEoli0w=";
 
   ldflags = [
     "-s"

pkgs/by-name/fs/fstar/package.nix

@@ -0,0 +1,121 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  installShellFiles,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  ocaml-ng,
+  removeReferencesTo,
+  util-linux,
+  which,
+}:
+
+let
+  # The version of ocaml fstar uses.
+  ocamlPackages = ocaml-ng.ocamlPackages_4_14;
+
+  fstarZ3 = callPackage ./z3 { };
+in
+ocamlPackages.buildDunePackage rec {
+  pname = "fstar";
+  version = "2025.03.25";
+
+  src = fetchFromGitHub {
+    owner = "FStarLang";
+    repo = "FStar";
+    rev = "v${version}";
+    hash = "sha256-PhjfThXF6fJlFHtNEURG4igCnM6VegWODypmRvnZPdA=";
+  };
+
+  duneVersion = "3";
+
+  nativeBuildInputs = [
+    ocamlPackages.menhir
+    which
+    util-linux
+    installShellFiles
+    makeWrapper
+    removeReferencesTo
+  ];
+
+  prePatch = ''
+    patchShebangs .scripts/*.sh
+    patchShebangs ulib/ml/app/ints/mk_int_file.sh
+  '';
+
+  buildInputs = with ocamlPackages; [
+    batteries
+    menhir
+    menhirLib
+    pprint
+    ppx_deriving
+    ppx_deriving_yojson
+    ppxlib
+    process
+    sedlex
+    stdint
+    yojson
+    zarith
+    memtrace
+    mtime
+  ];
+
+  preConfigure = ''
+    mkdir -p cache
+    export DUNE_CACHE_ROOT="$(pwd)/cache"
+    export PATH="${lib.makeBinPath [ fstarZ3 ]}''${PATH:+:}$PATH"
+    export PREFIX="$out"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make -j$NIX_BUILD_CORES
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    make install
+
+    remove-references-to -t '${ocamlPackages.ocaml}' $out/bin/fstar.exe
+
+    for binary in $out/bin/*; do
+      wrapProgram "$binary" --prefix PATH : "${lib.makeBinPath [ fstarZ3 ]}"
+    done
+
+    src="$(pwd)"
+    cd $out
+    installShellCompletion --bash $src/.completion/bash/fstar.exe.bash
+    installShellCompletion --fish $src/.completion/fish/fstar.exe.fish
+    installShellCompletion --zsh --name _fstar.exe $src/.completion/zsh/__fstar.exe
+    cd $src
+
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v(\d{4}\.\d{2}\.\d{2})$"
+      ];
+    };
+    z3 = fstarZ3;
+  };
+
+  meta = with lib; {
+    description = "ML-like functional programming language aimed at program verification";
+    homepage = "https://www.fstar-lang.org";
+    changelog = "https://github.com/FStarLang/FStar/raw/v${version}/CHANGES.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      numinit
+    ];
+    mainProgram = "fstar.exe";
+    platforms = with platforms; darwin ++ linux;
+  };
+}

pkgs/by-name/fs/fstar/z3/4-8-5-typos.diff

@@ -0,0 +1,26 @@
+diff --git a/src/util/lp/lp_core_solver_base.h b/src/util/lp/lp_core_solver_base.h
+index 4c17df2..4c3c311 100644
+--- a/src/util/lp/lp_core_solver_base.h
++++ b/src/util/lp/lp_core_solver_base.h
+@@ -600,8 +600,6 @@ public:
+            out << " \n";
+     }
+ 
+-    bool column_is_free(unsigned j) const { return this->m_column_type[j] == free; }
+-
+     bool column_has_upper_bound(unsigned j) const {
+         switch(m_column_types[j]) {
+         case column_type::free_column:
+diff --git a/src/util/lp/static_matrix_def.h b/src/util/lp/static_matrix_def.h
+index 7949573..2f1cb42 100644
+--- a/src/util/lp/static_matrix_def.h
++++ b/src/util/lp/static_matrix_def.h
+@@ -86,7 +86,7 @@ static_matrix<T, X>::static_matrix(static_matrix const &A, unsigned * /* basis *
+     init_row_columns(m, m);
+     while (m--) {
+         for (auto & col : A.m_columns[m]){
+-            set(col.var(), m, A.get_value_of_column_cell(col));
++            set(col.var(), m, A.get_column_cell(col));
+         }
+     }
+ }

pkgs/by-name/fs/fstar/z3/default.nix

@@ -0,0 +1,106 @@
+{
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+  replaceVars,
+  stdenvNoCC,
+  z3,
+}:
+
+let
+  # fstar has a pretty hard dependency on certain z3 patch versions.
+  # https://github.com/FStarLang/FStar/issues/3689#issuecomment-2625073641
+  # We need to package all the Z3 versions it prefers here.
+  fstarNewZ3Version = "4.13.3";
+  fstarNewZ3 =
+    if z3.version == fstarNewZ3Version then
+      z3
+    else
+      z3.overrideAttrs (final: rec {
+        version = fstarNewZ3Version;
+        src = fetchFromGitHub {
+          owner = "Z3Prover";
+          repo = "z3";
+          rev = "z3-${version}";
+          hash = "sha256-odwalnF00SI+sJGHdIIv4KapFcfVVKiQ22HFhXYtSvA=";
+        };
+      });
+
+  fstarOldZ3Version = "4.8.5";
+  fstarOldZ3 =
+    if z3.version == fstarOldZ3Version then
+      z3
+    else
+      z3.overrideAttrs (prev: rec {
+        version = fstarOldZ3Version;
+        src = fetchFromGitHub {
+          owner = "Z3Prover";
+          repo = "z3";
+          rev = "Z3-${version}"; # caps matter
+          hash = "sha256-ytG5O9HczbIVJAiIGZfUXC/MuYH7d7yLApaeTRlKXoc=";
+        };
+        patches =
+          let
+            static-matrix-patch = fetchpatch {
+              # clang / gcc fixes. fixes typos in some member names
+              name = "gcc-15-fixes.patch";
+              url = "https://github.com/Z3Prover/z3/commit/2ce89e5f491fa817d02d8fdce8c62798beab258b.patch";
+              includes = [ "src/@dir@/lp/static_matrix.h" ];
+              stripLen = 3;
+              extraPrefix = "src/@dir@/";
+              hash = "sha256-+H1/VJPyI0yq4M/61ay8SRCa6OaoJ/5i+I3zVTAPUVo=";
+            };
+
+            # replace @dir@ in the path of the given list of patches
+            fixupPatches = dir: map (patch: replaceVars patch { dir = dir; });
+          in
+          prev.patches or [ ]
+          ++ fixupPatches "util" [
+            ./lower-bound-typo.diff
+            static-matrix-patch
+            ./tail-matrix.diff
+          ]
+          ++ [
+            ./4-8-5-typos.diff
+          ];
+
+        postPatch =
+          let
+            python = lib.findFirst (pkg: lib.hasPrefix "python" pkg.pname) null prev.nativeBuildInputs;
+          in
+
+          assert python != null;
+
+          prev.postPatch or ""
+          +
+            lib.optionalString
+              ((lib.versionAtLeast python.version "3.12") && (lib.versionOlder version "4.8.14"))
+              ''
+                # See https://github.com/Z3Prover/z3/pull/5729. This is a specialization of this patch for 4.8.5.
+                for file in scripts/mk_util.py src/api/python/CMakeLists.txt; do
+                  substituteInPlace "$file" \
+                    --replace-fail "distutils.sysconfig.get_python_lib()" "sysconfig.get_path('purelib')" \
+                    --replace-fail "distutils.sysconfig" "sysconfig"
+                done
+              '';
+
+      });
+in
+stdenvNoCC.mkDerivation {
+  name = "fstar-z3";
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    ln -s ${lib.getExe fstarNewZ3} $out/bin/z3-${lib.escapeShellArg fstarNewZ3.version}
+    ln -s ${lib.getExe fstarOldZ3} $out/bin/z3-${lib.escapeShellArg fstarOldZ3.version}
+  '';
+
+  passthru = rec {
+    new = fstarNewZ3;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = new;
+
+    old = fstarOldZ3;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = old;
+  };
+}

pkgs/by-name/fs/fstar/z3/lower-bound-typo.diff

@@ -0,0 +1,13 @@
+diff --git a/src/@dir@/lp/column_info.h b/src/@dir@/lp/column_info.h
+index 1dc0c60..9cbeea6 100644
+--- a/src/@dir@/lp/column_info.h
++++ b/src/@dir@/lp/column_info.h
+@@ -47,7 +47,7 @@ public:
+             m_lower_bound_is_strict == c.m_lower_bound_is_strict &&
+             m_upper_bound_is_set == c.m_upper_bound_is_set&&
+             m_upper_bound_is_strict == c.m_upper_bound_is_strict&&
+-            (!m_lower_bound_is_set || m_lower_bound == c.m_low_bound) &&
++            (!m_lower_bound_is_set || m_lower_bound == c.m_lower_bound) &&
+             (!m_upper_bound_is_set || m_upper_bound == c.m_upper_bound) &&
+             m_cost == c.m_cost &&
+             m_is_fixed == c.m_is_fixed &&

pkgs/by-name/fs/fstar/z3/tail-matrix.diff

@@ -0,0 +1,12 @@
+diff --git a/src/@dir@/lp/tail_matrix.h b/src/@dir@/lp/tail_matrix.h
+index 2047e8c..c84340e 100644
+--- a/src/@dir@/lp/tail_matrix.h
++++ b/src/@dir@/lp/tail_matrix.h
+@@ -43,7 +43,6 @@ public:
+         const tail_matrix & m_A;
+         unsigned m_row;
+         ref_row(const tail_matrix& m, unsigned row): m_A(m), m_row(row) {}
+-        T operator[](unsigned j) const { return m_A.get_elem(m_row, j);}
+     };
+     ref_row operator[](unsigned i) const { return ref_row(*this, i);}
+ };

pkgs/by-name/ga/gapless/package.nix

@@ -16,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gapless";
-  version = "4.3.1";
+  version = "4.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "neithern";
     repo = "g4music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zLjpYGZR/o76onSjwfpHEx26vd8rUa/1PXL+DuC8C2o=";
+    hash = "sha256-10AFaUmqVkL4q8xgewfosN2/SziNhat9p6x/+9mBdyU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ge/gearlever/package.nix

@@ -11,24 +11,26 @@
   desktop-file-utils,
   libadwaita,
   file,
-  p7zip,
+  _7zz,
   which,
   appimage-run,
   gtk4,
   bintools,
   libnotify,
+  dwarfs,
+  squashfsTools,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "gearlever";
-  version = "3.0.2";
+  version = "3.2.2";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "mijorus";
     repo = "gearlever";
     tag = version;
-    hash = "sha256-b5CH7qJKsXwARCIv4EiwGcc3nH/GKGkb8gwxPWYAr4s=";
+    hash = "sha256-8gvulVq3RQZ/v7DCJ1Azrs23WMEznJCaalyjqD6iCU8=";
   };
 
   postPatch =
@@ -76,13 +78,15 @@ python3Packages.buildPythonApplication rec {
     "--prefix PATH : ${
       lib.makeBinPath [
         file
-        p7zip
+        _7zz # 7zz
         which
         appimage-run
         desktop-file-utils # update-desktop-database
         gtk4.dev # gtk4-launch
         bintools # readelf
         libnotify # notify-send
+        dwarfs # dwarfsextract, dwarfsck
+        squashfsTools # unsquashfs
       ]
     }"
   ];

pkgs/by-name/go/golangci-lint-langserver/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint-langserver";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "nametake";
     repo = "golangci-lint-langserver";
     tag = "v${version}";
-    hash = "sha256-wNofr/s8K+vbvNZWrQ97g2V0fNAS2P/Zf7tsOmly+gc=";
+    hash = "sha256-mwYhOUH5PAbPRfP86dw9w6lIZYz/iL+f863XWOhBFy0=";
   };
 
-  vendorHash = "sha256-SsGw26y/ZIBFp9dBk55ebQgJiLWOFRNe21h6huYE84I=";
+  vendorHash = "sha256-kbGTORTTxfftdU8ffsfh53nT7wZldOnBZ/1WWzN89Uc=";
 
   subPackages = [ "." ];
 

pkgs/by-name/he/hedgedoc/package.nix

@@ -56,6 +56,7 @@ stdenv.mkDerivation {
     makeBinaryWrapper
     (python3.withPackages (ps: with ps; [ setuptools ])) # required to build sqlite3 bindings
     yarn
+    writableTmpDirAsHomeHook # A writable home directory is required for yarn
   ];
 
   buildInputs = [
@@ -67,7 +68,6 @@ stdenv.mkDerivation {
   buildPhase = ''
     runHook preBuild
 
-    export HOME=$(mktemp -d)
     yarn config set enableTelemetry 0
     yarn config set cacheFolder ${offlineCache}
     export npm_config_nodedir=${nodejs} # prevent node-gyp from downloading headers

pkgs/by-name/ho/honeymarker/package.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeymarker";
+  version = "0.2.1";
+  vendorHash = "sha256-ZuDobjC/nizZ7G0o/zVTQmDfDjcdBhfPcmkhgwFc7VU=";
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeymarker";
+    rev = "v${version}";
+    hash = "sha256-tiwX94CRvXnUYpiux94XhOj2abn1Uc+wjcDOmw79ab4=";
+  };
+
+  meta = with lib; {
+    description = "provides a simple CRUD interface for dealing with per-dataset markers on honeycomb.io";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}

pkgs/by-name/ho/honeytail/package.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeytail";
+  version = "1.6.0";
+  vendorHash = "sha256-LtiiLGLjhbfT49A6Fw5CbSbnmTHMxtcUssr+ayCVrvY=";
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeytail";
+    rev = "v${version}";
+    hash = "sha256-S0hIgNNzF1eNe+XJs+PT7EUIl5oJCXu+B/zQago4sf8=";
+  };
+
+  meta = with lib; {
+    description = "agent for ingesting log file data into honeycomb.io and making it available for exploration";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}

pkgs/by-name/ho/honeyvent/package.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "honeyvent";
+  version = "1.1.0";
+  vendorHash = null;
+
+  src = fetchFromGitHub {
+    owner = "honeycombio";
+    repo = "honeyvent";
+    rev = "v${version}";
+    hash = "sha256-yFQEOshjaH6fRCQ7IZChANI9guZlTXk35p1NzQvxUdI=";
+  };
+
+  meta = with lib; {
+    description = "CLI for sending individual events to honeycomb.io";
+    homepage = "https://honeycomb.io/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.iand675 ];
+  };
+}

pkgs/by-name/is/isabelle/components/isabelle-linter.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "isabelle-linter";
-  version = "2024-1.0.1";
+  version = "2025-1.0.0";
 
   src = fetchFromGitHub {
     owner = "isabelle-prover";
     repo = "isabelle-linter";
-    rev = "Isabelle2024-v1.0.1";
-    hash = "sha256-oTrwcfJgbkpkIweDIyc6lZjAvdS9J4agPoJgZzH+PuQ=";
+    rev = "Isabelle2025-v1.0.0";
+    hash = "sha256-cH9EoIbKa6cqLjw83gnYvCy+Dq0d5fFmJCabdPrRJeI=";
   };
 
   nativeBuildInputs = [ isabelle ];

pkgs/by-name/is/isabelle/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   coreutils,
   nettools,
   java,
@@ -10,7 +11,6 @@
   veriT,
   vampire,
   eprover-ho,
-  naproche,
   rlwrap,
   perl,
   procps,
@@ -21,6 +21,15 @@
 }:
 
 let
+  vampire' = vampire.overrideAttrs (_: {
+    src = fetchFromGitHub {
+      owner = "vprover";
+      repo = "vampire";
+      tag = "v4.8HO4Sledgahammer";
+      hash = "sha256-CmppaGa4M9tkE1b25cY1LSPFygJy5yV4kpHKbPqvcVE=";
+    };
+  });
+
   sha1 = stdenv.mkDerivation {
     pname = "isabelle-sha1";
     version = "2024";
@@ -46,7 +55,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "isabelle";
-  version = "2024";
+  version = "2025";
 
   dirname = "Isabelle${version}";
 
@@ -54,17 +63,17 @@ stdenv.mkDerivation (finalAttrs: rec {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
-        hash = "sha256-IgNfmW9x6h8DBj9vFEGV62oEl01NkW7QdyzXlWmii8c=";
+        hash = "sha256-6ldUwiiFf12dOuJU7JgUeX8kU+opDfILL23LLvDi5/g=";
       }
     else if stdenv.hostPlatform.isx86 then
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-        hash = "sha256-YDqq+KvqNll687BlHSwWKobAoN1EIHZvR+VyQDljkmc=";
+        hash = "sha256-PR1m3jcYI/4xqormZjj3NXW6wkTwCzGu4dy2LzgUfFY=";
       }
     else
       fetchurl {
         url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux_arm.tar.gz";
-        hash = "sha256-jXWVv18WwrVnqVX1s4Lnyf7DkOzPa3EdLXYxgtKD+YA=";
+        hash = "sha256-p/Hp+7J5gJy5s6BVD5Ma1Mu2OS53I8BS7gKSOYYB0PE=";
       };
 
   nativeBuildInputs = [ java ];
@@ -72,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   buildInputs = [
     polyml
     veriT
-    vampire
+    vampire'
     eprover-ho
     nettools
   ];
@@ -103,8 +112,8 @@ stdenv.mkDerivation (finalAttrs: rec {
       EOF
 
       cat >contrib/vampire-*/etc/settings <<EOF
-        VAMPIRE_HOME=${vampire}/bin
-        VAMPIRE_VERSION=${vampire.version}
+        VAMPIRE_HOME=${vampire'}/bin
+        VAMPIRE_VERSION=${vampire'.version}
         VAMPIRE_EXTRA_OPTIONS="--mode casc"
       EOF
 
@@ -123,13 +132,6 @@ stdenv.mkDerivation (finalAttrs: rec {
         ISABELLE_JDK_HOME=${java}
       EOF
 
-    ''
-    + lib.optionalString stdenv.hostPlatform.isx86 ''
-      rm contrib/naproche-*/x86*/Naproche-SAD
-      ln -s ${naproche}/bin/Naproche-SAD contrib/naproche-*/x86*/
-    ''
-    + ''
-
       echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
       for comp in contrib/jdk* contrib/polyml-* contrib/verit-* contrib/vampire-* contrib/e-*; do

pkgs/by-name/jr/jrnl/package.nix

@@ -41,6 +41,8 @@ python3.pkgs.buildPythonApplication rec {
     rich
   ];
 
+  pythonRelaxDeps = [ "rich" ];
+
   nativeCheckInputs = with python3.pkgs; [
     pytest-bdd
     pytest-xdist

pkgs/by-name/ka/kahip/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  cmake,
+  mpi,
+  metis,
+  python3Packages,
+  pythonSupport ? false,
+  isILP64 ? false,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kahip";
+  version = "3.18";
+
+  src = fetchFromGitHub {
+    owner = "KaHIP";
+    repo = "KaHIP";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-l8DhVb2G6pQQcH3Wq4NsKw30cSK3sG+gCYRdpibw4ZI=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/KaHIP/KaHIP/commit/9d4978c7540a1ccbc9807367d6e3852114e86567.patch?full_index=1";
+      hash = "sha256-nIJL0YmVp9+JUhzEXjoabD1qNEnhtrBnjMWnitYt0eU=";
+    })
+  ];
+
+  nativeBuildInputs =
+    [ cmake ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.python
+      python3Packages.pybind11
+    ];
+
+  buildInputs = [
+    mpi
+    metis
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "64BITMODE" isILP64)
+    (lib.cmakeBool "BUILDPYTHONMODULE" pythonSupport)
+    (lib.cmakeFeature "CMAKE_INSTALL_PYTHONDIR" python3Packages.python.sitePackages)
+  ];
+
+  doInstallCheck = pythonSupport;
+
+  nativeInstallCheckInputs = lib.optionals pythonSupport [
+    python3Packages.pythonImportsCheckHook
+  ];
+
+  pythonImportsCheck = [ "kahip" ];
+
+  meta = {
+    homepage = "https://kahip.github.io/";
+    downloadPage = "https://github.com/KaHIP/KaHIP/";
+    changelog = "https://github.com/KaHIP/KaHIP/releases/tag/v${finalAttrs.version}";
+    description = "Karlsruhe HIGH Quality Partitioning";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+})

pkgs/by-name/ka/kalker/package.nix

@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   gmp,
   mpfr,
   libmpc,
@@ -19,7 +20,17 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IYxgh6ni3BFnocHGKwKUqgSC2xUjn0b/4pBqRC5iY8U=";
+  cargoHash = "sha256-LEP2ebthwtpPSRmJt0BW/T/lB6EE+tylyVv+PDt8UoQ=";
+
+  cargoPatches = [
+    # Fixes build issue by just running cargo update
+    # Can be removed on next release
+    (fetchpatch {
+      name = "bump_cargo_deps.patch";
+      url = "https://github.com/PaddiM8/kalker/commit/81bf66950a9dfeca4ab5fdd12774c93e40021eb1.patch";
+      hash = "sha256-XT8jXTMIMOFw8OieoQM7IkUqw3SDi1c9eE1cD15BI9I=";
+    })
+  ];
 
   buildInputs = [
     gmp

pkgs/by-name/ki/kismet/package.nix

@@ -15,6 +15,7 @@
   lm_sensors,
   networkmanager,
   nix-update-script,
+  nixosTests,
   pcre2,
   pkg-config,
   openssl,
@@ -115,6 +116,7 @@ stdenv.mkDerivation (finalPackage: {
   enableParallelBuilding = true;
 
   passthru = {
+    tests.kismet = nixosTests.kismet;
     updateScript = nix-update-script {
       extraArgs = [
         "--version-regex"

pkgs/by-name/li/libndctl/musl-compat.patch

@@ -0,0 +1,22 @@
+diff --git a/daxctl/device.c b/daxctl/device.c
+index e3993b1..0b2f20d 100644
+--- a/daxctl/device.c
++++ b/daxctl/device.c
+@@ -23,6 +23,8 @@
+ #include "filter.h"
+ #include "json.h"
+ 
++#include <libgen.h>
++
+ static struct {
+ 	const char *dev;
+ 	const char *mode;
+@@ -366,7 +368,7 @@ static const char *parse_device_options(int argc, const char **argv,
+ 
+ 	argc = parse_options(argc, argv, options, u, 0);
+ 	if (argc > 0)
+-		device = basename(argv[0]);
++		device = basename(strdup(argv[0]));
+ 
+ 	/* Handle action-agnostic non-option arguments */
+ 	if (argc == 0 &&

pkgs/by-name/li/libndctl/package.nix

@@ -25,6 +25,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gG1Rz5AtDLzikGFr8A3l25ypd+VoLw2oWjszy9ogDLk=";
   };
 
+  patches = lib.optionals (!stdenv.hostPlatform.isGnu) [
+    # Use POSIX basename on non-glib.
+    # Remove when https://github.com/pmem/ndctl/pull/263
+    # or equivalent fix is merged and released.
+    ./musl-compat.patch
+  ];
+
   outputs = [
     "out"
     "man"

pkgs/by-name/li/libofa/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
   expat,
   curl,
   fftw,
@@ -17,11 +18,22 @@ stdenv.mkDerivation rec {
     sha256 = "184ham039l7lwhfgg0xr2vch2xnw1lwh7sid432mh879adhlc5h2";
   };
 
-  patches = fetchurl {
+  debian_patches = fetchzip {
     url = "mirror://debian/pool/main/libo/libofa/libofa_${version}-${deb_patch}.debian.tar.gz";
-    sha256 = "1rfkyz13cm8izm90c1xflp4rvsa24aqs6qpbbbqqcbmvzsj6j9yn";
+    hash = "sha256-tENhXSRcUP1PKm35IJyLUEEROze8UzxJzRx3VNAqo40=";
   };
 
+  patches = [
+    "${debian_patches}/patches/01_gcc41.diff"
+    "${debian_patches}/patches/02_example-open.diff"
+    "${debian_patches}/patches/03_example-size_type.diff"
+    "${debian_patches}/patches/04_libofa.pc-deps.diff"
+    "${debian_patches}/patches/05_gcc43.diff"
+    "${debian_patches}/patches/06_gcc44.diff"
+    "${debian_patches}/patches/fix_ftbfs.diff"
+    "${debian_patches}/patches/fix-ftbfs-gcc4.7.diff"
+  ];
+
   outputs = [
     "out"
     "dev"

pkgs/by-name/ma/mattermost/tests.nix

@@ -39,9 +39,10 @@ mattermost.overrideAttrs (
       + ''
         # Just echo install/get/mod commands in the Makefile, since the dependencies are locked.
         substituteInPlace server/Makefile \
-          --replace-warn '$(GO) install' '@echo $(GO) install' \
-          --replace-warn '$(GO) get' '@echo $(GO) get' \
-          --replace-warn '$(GO) get' '@echo $(GO) mod'
+          --replace-warn '$(GO) install' 'echo $(GO) install' \
+          --replace-warn '$(GOBIN)/go$$version download' 'echo $(GOBIN)/go$$version download' \
+          --replace-warn '$(GO) get' 'echo $(GO) get' \
+          --replace-warn '$(GO) get' 'echo $(GO) mod'
         # mmctl tests shell out by writing a bash script to a tempfile
         substituteInPlace server/cmd/mmctl/commands/config_e2e_test.go \
           --replace-fail '#!/bin/bash' '#!${runtimeShell}'
@@ -142,6 +143,9 @@ mattermost.overrideAttrs (
         # Appear to be broken.
         "TestSessionStore/MySQL/SessionGetWithDeviceId"
         "TestSessionStore/MySQL/GetMobileSessionMetadata"
+        "TestSessionStore/MySQL/GetSessionsWithActiveDeviceIds"
+        "TestUpdateTeam"
+        "TestSyncSyncableRoles"
       ]
       ++ optionals (!stdenv.hostPlatform.isx86_64) [
         # aarch64: invalid operating system or processor architecture

pkgs/by-name/me/media-downloader/package.nix

@@ -1,7 +1,6 @@
 {
   aria2,
   cmake,
-  # https://github.com/mhogomchungu/media-downloader?tab=readme-ov-file#extensions
   extraPackages ? [
     aria2
     ffmpeg
@@ -10,8 +9,8 @@
   fetchFromGitHub,
   ffmpeg,
   lib,
-  libsForQt5,
   python3,
+  qt6,
   stdenv,
 }:
 
@@ -28,10 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
-  buildInputs = [ libsForQt5.qtbase ];
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+  ];
 
   qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath extraPackages}" ];
 

pkgs/by-name/mi/min-ed-launcher/deps.json

@@ -0,0 +1,257 @@
+[
+  {
+    "pname": "Expecto",
+    "version": "10.2.1",
+    "hash": "sha256-DgwHFsPMySlnMag4kPTviTwrNOD7uPnnJLi9DCZif5s="
+  },
+  {
+    "pname": "Expecto.FsCheck",
+    "version": "10.2.1",
+    "hash": "sha256-+IDkxZKfEir5/TJrwxMFC4H6voWbSmCsvZUrjxcbc50="
+  },
+  {
+    "pname": "FsCheck",
+    "version": "2.16.5",
+    "hash": "sha256-+UXoE+QGCDN1LM+XgseKJ7c5Lj/Cblo3izmo7GtIE0A="
+  },
+  {
+    "pname": "FsConfig",
+    "version": "4.1.0",
+    "hash": "sha256-daaTrzhZjnJLDL49vOCkeXX6W5PWaLj5aqHuaYgiS1s="
+  },
+  {
+    "pname": "FSharp.Core",
+    "version": "8.0.200",
+    "hash": "sha256-wjYiedFiqOTKaM4mF6uT9kc/yKDJ78mqfw9qLoBFHOw="
+  },
+  {
+    "pname": "FSharp.Data",
+    "version": "6.4.0",
+    "hash": "sha256-8/iQA6anTybzseyvsvFV33jVVwrnYiKG1iqgwkqNeRc="
+  },
+  {
+    "pname": "FSharp.Data.Csv.Core",
+    "version": "6.4.0",
+    "hash": "sha256-jcw/6uDN0he/PhhopEvTydy2X13Xt3g3kKuVdt+8+oY="
+  },
+  {
+    "pname": "FSharp.Data.Html.Core",
+    "version": "6.4.0",
+    "hash": "sha256-HeljybTU019Z7HxFoErPM/HIAm32pJiKQM+kSyt63xw="
+  },
+  {
+    "pname": "FSharp.Data.Http",
+    "version": "6.4.0",
+    "hash": "sha256-Zn4dZCb46vr8LYR5donzeistFPSO8YYiXUU3Iqo+vKg="
+  },
+  {
+    "pname": "FSharp.Data.Json.Core",
+    "version": "6.4.0",
+    "hash": "sha256-dVhcVzUi//PFFFIML/5SWKrileeQ6IOd1VlGyEptaw0="
+  },
+  {
+    "pname": "FSharp.Data.Runtime.Utilities",
+    "version": "6.4.0",
+    "hash": "sha256-nD4U7mwZtFEUcD9XvPxhpot8FNl2YyhiLpjpjmFNAO0="
+  },
+  {
+    "pname": "FSharp.Data.WorldBank.Core",
+    "version": "6.4.0",
+    "hash": "sha256-ea2CZyHisqa1MnF70TBKfcMl6+W90MnLJ5Ctgjfk9SM="
+  },
+  {
+    "pname": "FSharp.Data.Xml.Core",
+    "version": "6.4.0",
+    "hash": "sha256-6eZWKdNjKMqufyOYolTximIS41gipBUNMKNn3HEiYw0="
+  },
+  {
+    "pname": "FSharpx.Collections",
+    "version": "3.1.0",
+    "hash": "sha256-CmDCfx19VNthqZHphYywOK0attxyJjOhu2srNKSky10="
+  },
+  {
+    "pname": "FsToolkit.ErrorHandling",
+    "version": "4.15.2",
+    "hash": "sha256-fzsnH7178Gr0pnFoXkJvqRc2s5c+MXuRKQHBifIhmQk="
+  },
+  {
+    "pname": "FsToolkit.ErrorHandling.TaskResult",
+    "version": "4.15.2",
+    "hash": "sha256-I/3BXTQQzVSlldcfaVZ849/PirOcozM5GLCmfL2qHWg="
+  },
+  {
+    "pname": "Microsoft.CodeCoverage",
+    "version": "17.9.0",
+    "hash": "sha256-OaGa4+jRPHs+T+p/oekm2Miluqfd2IX8Rt+BmUx8kr4="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration",
+    "version": "8.0.0",
+    "hash": "sha256-9BPsASlxrV8ilmMCjdb3TiUcm5vFZxkBnAI/fNBSEyA="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Abstractions",
+    "version": "8.0.0",
+    "hash": "sha256-4eBpDkf7MJozTZnOwQvwcfgRKQGcNXe0K/kF+h5Rl8o="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Binder",
+    "version": "8.0.1",
+    "hash": "sha256-KYPQYYspiBGiez7JshmEjy4kFt7ASzVxQeVsygIEvHA="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.FileExtensions",
+    "version": "8.0.0",
+    "hash": "sha256-BCxcjVP+kvrDDB0nzsFCJfU74UK4VBvct2JA4r+jNcs="
+  },
+  {
+    "pname": "Microsoft.Extensions.Configuration.Json",
+    "version": "8.0.0",
+    "hash": "sha256-Fi/ijcG5l0BOu7i96xHu96aN5/g7zO6SWQbTsI3Qetg="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
+    "version": "8.0.0",
+    "hash": "sha256-uQSXmt47X2HGoVniavjLICbPtD2ReQOYQMgy3l0xuMU="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileProviders.Physical",
+    "version": "8.0.0",
+    "hash": "sha256-29y5ZRQ1ZgzVOxHktYxyiH40kVgm5un2yTGdvuSWnRc="
+  },
+  {
+    "pname": "Microsoft.Extensions.FileSystemGlobbing",
+    "version": "8.0.0",
+    "hash": "sha256-+Oz41JR5jdcJlCJOSpQIL5OMBNi+1Hl2d0JUHfES7sU="
+  },
+  {
+    "pname": "Microsoft.Extensions.Primitives",
+    "version": "8.0.0",
+    "hash": "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="
+  },
+  {
+    "pname": "Microsoft.Extensions.TimeProvider.Testing",
+    "version": "8.5.0",
+    "hash": "sha256-ZGXrOV/qJVfjwrJsv3jtC80IVQyH3OLOw70gCIn6uIM="
+  },
+  {
+    "pname": "Microsoft.NET.Test.Sdk",
+    "version": "17.9.0",
+    "hash": "sha256-q/1AJ7eNlk02wvN76qvjl2xBx5iJ+h5ssiE/4akLmtI="
+  },
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "5.0.0",
+    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.ObjectModel",
+    "version": "17.9.0",
+    "hash": "sha256-iiXUFzpvT8OWdzMj9FGJDqanwHx40s1TXVY9l3ii+s0="
+  },
+  {
+    "pname": "Microsoft.TestPlatform.TestHost",
+    "version": "17.9.0",
+    "hash": "sha256-1BZIY1z+C9TROgdTV/tq4zsPy7Q71GQksr/LoMKAzqU="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "5.0.0",
+    "hash": "sha256-9kylPGfKZc58yFqNKa77stomcoNnMeERXozWJzDcUIA="
+  },
+  {
+    "pname": "Mono.Cecil",
+    "version": "0.11.4",
+    "hash": "sha256-HrnRgFsOzfqAWw0fUxi/vkzZd8dMn5zueUeLQWA9qvs="
+  },
+  {
+    "pname": "Mono.Posix.NETStandard",
+    "version": "5.20.1-preview",
+    "hash": "sha256-gLtcH308/VVYgZcrJtvXDkBIMIQjK8w35AcmuxYYTvM="
+  },
+  {
+    "pname": "Newtonsoft.Json",
+    "version": "13.0.1",
+    "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
+  },
+  {
+    "pname": "Serilog",
+    "version": "3.1.1",
+    "hash": "sha256-L263y8jkn7dNFD2jAUK6mgvyRTqFe39i1tRhVZsNZTI="
+  },
+  {
+    "pname": "Serilog.Sinks.Console",
+    "version": "5.0.1",
+    "hash": "sha256-aveoZM25ykc2haBHCXWD09jxZ2t2tYIGmaNTaO2V0jI="
+  },
+  {
+    "pname": "Serilog.Sinks.File",
+    "version": "5.0.0",
+    "hash": "sha256-GKy9hwOdlu2W0Rw8LiPyEwus+sDtSOTl8a5l9uqz+SQ="
+  },
+  {
+    "pname": "Serilog.Sinks.File.Header",
+    "version": "1.0.2",
+    "hash": "sha256-2igOXIHtojhhNlg/C5OhPwmVUoE5MpmgApi8dFmutx4="
+  },
+  {
+    "pname": "System.Collections.Immutable",
+    "version": "6.0.0",
+    "hash": "sha256-DKEbpFqXCIEfqp9p3ezqadn5b/S1YTk32/EQK+tEScs="
+  },
+  {
+    "pname": "System.Reflection.Metadata",
+    "version": "1.6.0",
+    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
+  },
+  {
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "6.0.0",
+    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "5.0.0",
+    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
+  },
+  {
+    "pname": "System.Security.Cryptography.ProtectedData",
+    "version": "8.0.0",
+    "hash": "sha256-fb0pa9sQxN+mr0vnXg1Igbx49CaOqS+GDkTfWNboUvs="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "8.0.0",
+    "hash": "sha256-+YUPY+3HnTmfPLZzr+5qEk0RqalCbFZBgLXee1yCH1M="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "5.0.0",
+    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
+  },
+  {
+    "pname": "System.Text.Encodings.Web",
+    "version": "8.0.0",
+    "hash": "sha256-IUQkQkV9po1LC0QsqrilqwNzPvnc+4eVvq+hCvq8fvE="
+  },
+  {
+    "pname": "System.Text.Json",
+    "version": "8.0.0",
+    "hash": "sha256-XFcCHMW1u2/WujlWNHaIWkbW1wn8W4kI0QdrwPtWmow="
+  },
+  {
+    "pname": "System.Windows.Extensions",
+    "version": "8.0.0",
+    "hash": "sha256-aHkz7LtmUDDRS7swQM0i6dDVUytRCMYeA2CfaeVA2Y0="
+  },
+  {
+    "pname": "TypeShape",
+    "version": "10.0.0",
+    "hash": "sha256-esJFuRvxuLXwBgi/7FjEVm1ATCGXU/yB2RtgN4ilZtg="
+  },
+  {
+    "pname": "YoloDev.Expecto.TestSdk",
+    "version": "0.14.3",
+    "hash": "sha256-3FIZM+GYsBsFGhLsasF7Ia9nXHSpqooQNe5H7ANy334="
+  }
+]

pkgs/by-name/mi/min-ed-launcher/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  git,
+}:
+buildDotnetModule rec {
+  pname = "min-ed-launcher";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "rfvgyhn";
+    repo = "min-ed-launcher";
+    tag = "v${version}";
+    hash = "sha256-HJIvbuTsCG51PPVieJbXGyAviqgM9/WPz0+0VhIWz9k=";
+
+    leaveDotGit = true; # During build the current commit is appended to the version
+  };
+
+  projectFile = "MinEdLauncher.sln";
+  nugetDeps = ./deps.json;
+  buildInputs = [
+    git # During build the current commit is appended to the version
+  ];
+
+  executables = [ "MinEdLauncher" ];
+
+  meta = {
+    homepage = "https://github.com/rfvgyhn/min-ed-launcher";
+    description = "Minimal Elite Dangerous Launcher";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.x86_64;
+    mainProgram = "MinEdLauncher";
+    maintainers = with lib.maintainers; [ jiriks74 ];
+  };
+}

pkgs/by-name/mo/monkeysAudio/package.nix

@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.05";
+  version = "11.08";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-CHOkP5L5FITV2ZpeYjSL9r8K6eeG/p4ZBrUztRvnIU4=";
+    hash = "sha256-iy/WFFRv3/ZJoGCAKH2+rYnyIdvaO+kgxaH/XeKWtbs=";
     stripRoot = false;
   };
 

pkgs/by-name/ne/neohtop/package.nix

@@ -11,7 +11,6 @@
   fetchFromGitHub,
   glib,
   gtk3,
-  libsoup_2_4,
   openssl,
   nix-update-script,
 }:
@@ -51,7 +50,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     glib
     gtk3
     openssl
-    libsoup_2_4
     webkitgtk_4_1
   ];
 

pkgs/by-name/ne/newsflash/package.nix

@@ -12,7 +12,7 @@
   rustc,
   wrapGAppsHook4,
   gdk-pixbuf,
-  clapper,
+  clapper-unwrapped,
   gtk4,
   libadwaita,
   libxml2,
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      clapper
+      clapper-unwrapped
       gtk4
       libadwaita
       libxml2

pkgs/by-name/ne/nextcloud-talk-desktop/package.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nextcloud-talk-desktop";
-  version = "1.1.5";
+  version = "1.1.6";
 
   # Building from source would require building also building Server and Talk components
   # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
   src = fetchzip {
     url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${finalAttrs.version}/Nextcloud.Talk-linux-x64.zip";
-    hash = "sha256-KI6EJxsiIPjk+SBdqAwQNpaMZgVQSra/tqCGufQYSPs=";
+    hash = "sha256-+bKE9taQxOrxB9tBP3PReyZlict6/gEX5uWbuzGIa8k=";
     stripRoot = false;
   };
 

pkgs/by-name/ne/nezha-theme-nazhua/package.nix

@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nezha-theme-nazhua";
-  version = "0.6.4";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "hi2shark";
     repo = "nazhua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9mBM8M9pPZMMyFcf4JOyY5rnhpiNEy8ZDDnEoopjcbg=";
+    hash = "sha256-Flx0yHhYGDM9qPIsE1ZfjdmuWXbDTodnaiVK7Hee3Z4=";
   };
 
   yarnOfflineCache = fetchYarnDeps {