Merge staging-next into staging

doc/doc-support/lib-function-docs.nix

@@ -4,24 +4,31 @@
 
 with pkgs;
 
-let
-  locationsJSON = import ./lib-function-locations.nix { inherit pkgs nixpkgs libsets; };
-in
 stdenv.mkDerivation {
   name = "nixpkgs-lib-docs";
-  src = ../../lib;
+  src = pkgs.lib.fileset.toSource {
+    root = ../..;
+    fileset = ../../lib;
+  };
 
-  buildInputs = [ nixdoc ];
+  buildInputs = [ nixdoc nix ];
   installPhase = ''
+    export NIX_STATE_DIR=$(mktemp -d)
+    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
+      --arg nixpkgsPath "./." \
+      --argstr revision ${nixpkgs.rev or "master"} \
+      --argstr libsetsJSON ${pkgs.lib.escapeShellArg (builtins.toJSON libsets)} \
+      > locations.json
+
     function docgen {
       name=$1
       baseName=$2
       description=$3
       # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "../lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName.nix" > "$out/$name.md"
+      if [[ -e "lib/$baseName.nix" ]]; then
+        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
       else
-        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName/default.nix" > "$out/$name.md"
+        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
       fi
       echo "$out/$name.md" >> "$out/index.md"
     }

doc/doc-support/lib-function-locations.nix

@@ -1,13 +1,14 @@
-{ pkgs, nixpkgs ? { }, libsets }:
+{ nixpkgsPath, revision, libsetsJSON }:
 let
-  revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.rev or "master");
+  lib = import (nixpkgsPath + "/lib");
+  libsets = builtins.fromJSON libsetsJSON;
 
   libDefPos = prefix: set:
     builtins.concatMap
       (name: [{
         name = builtins.concatStringsSep "." (prefix ++ [name]);
         location = builtins.unsafeGetAttrPos name set;
-      }] ++ nixpkgsLib.optionals
+      }] ++ lib.optionals
         (builtins.length prefix == 0 && builtins.isAttrs set.${name})
         (libDefPos (prefix ++ [name]) set.${name})
       ) (builtins.attrNames set);
@@ -20,8 +21,6 @@ let
       })
       (builtins.map (x: x.name) libsets);
 
-  nixpkgsLib = pkgs.lib;
-
   flattenedLibSubset = { subsetname, functions }:
   builtins.map
     (fn: {
@@ -38,13 +37,13 @@ let
       substr = builtins.substring prefixLen filenameLen filename;
       in substr;
 
-  removeNixpkgs = removeFilenamePrefix (builtins.toString pkgs.path);
+  removeNixpkgs = removeFilenamePrefix (builtins.toString nixpkgsPath);
 
   liblocations =
     builtins.filter
       (elem: elem.value != null)
-      (nixpkgsLib.lists.flatten
-        (locatedlibsets nixpkgsLib));
+      (lib.lists.flatten
+        (locatedlibsets lib));
 
   fnLocationRelative = { name, value }:
     {
@@ -72,4 +71,4 @@ let
     relativeLocs);
 
 in
-pkgs.writeText "locations.json" (builtins.toJSON jsonLocs)
+jsonLocs

doc/languages-frameworks/go.section.md

@@ -66,6 +66,25 @@ The following is an example expression using `buildGoModule`:
 
 The function `buildGoPackage` builds legacy Go programs, not supporting Go modules.
 
+::: {.warning}
+`buildGoPackage` is deprecated and will be removed for the 25.05 release.
+:::
+
+### Migrating from `buildGoPackage` to `buildGoModule` {#buildGoPackage-migration}
+
+Go modules, released 6y ago, are now widely adopted in the ecosystem.
+Most upstream projects are using Go modules, and the tooling previously used for dependency management in Go is mostly deprecated, archived or at least unmaintained at this point.
+
+In case a project doesn't have external dependencies or dependencies are vendored in a way understood by `go mod init`, migration can be done with a few changes in the package.
+
+- Switch the builder from `buildGoPackage` to `buildGoModule`
+- Remove `goPackagePath` and other attributes specific to `buildGoPackage`
+- Set `vendorHash = null;`
+- Run `go mod init <module name>` in `postPatch`
+
+In case the package has external dependencies that aren't vendored or the build setup is more complex the upstream source might need to be patched.
+Examples for the migration can be found in the [issue tracking migration withing nixpkgs](https://github.com/NixOS/nixpkgs/issues/318069).
+
 ### Example for `buildGoPackage` {#example-for-buildgopackage}
 
 In the following is an example expression using `buildGoPackage`, the following arguments are of special significance to the function:

maintainers/maintainer-list.nix

@@ -6634,6 +6634,12 @@
     githubId = 5741401;
     name = "Tim Windelschmidt";
   };
+  fiq = {
+    email = "raf+git@dreamthought.com";
+    github = "fiq";
+    githubId = 236293;
+    name = "Raf Gemmail";
+  };
   firefly-cpp = {
     email = "iztok@iztok-jr-fister.eu";
     github = "firefly-cpp";
@@ -11124,6 +11130,12 @@
     github = "kylehendricks";
     githubId = 981958;
   };
+  kylelovestoad = {
+    name = "kylelovestoad";
+    github = "kylelovestoad";
+    githubId = 20408518;
+    email = "kylelovestoad+nixpkgs@protonmail.com";
+  };
   kyleondy = {
     email = "kyle@ondy.org";
     github = "KyleOndy";
@@ -13175,6 +13187,13 @@
     github = "michaeldonovan";
     githubId = 14077230;
   };
+  michaelglass = {
+    email = "nixpkgs@mike.is";
+    name = "Michael Glass";
+    github = "michaelglass";
+    githubId = 60136;
+    keys = [ { fingerprint = "46AF 8625 D92A 219B 8E6D  B7F8 9CDD 3769 1649 1385"; } ];
+  };
   michaelgrahamevans = {
     email = "michaelgrahamevans@gmail.com";
     name = "Michael Evans";
@@ -14060,6 +14079,7 @@
   };
   n8henrie = {
     name = "Nathan Henrie";
+    email = "nate@n8henrie.com";
     github = "n8henrie";
     githubId = 1234956;
     "keys" = [ { "fingerprint" = "F21A 6194 C9DB 9899 CD09 E24E 434B 2C14 B8C3 3422"; } ];
@@ -16185,11 +16205,6 @@
     github = "polygon";
     githubId = 51489;
   };
-  polykernel = {
-    github = "polykernel";
-    githubId = 81340136;
-    name = "polykernel";
-  };
   polyrod = {
     email = "dc1mdp@gmail.com";
     github = "polyrod";
@@ -18149,6 +18164,12 @@
     githubId = 4983935;
     keys = [ { fingerprint = "30BB FF3F AB0B BB3E 0435  F83C 8E8F F66E 2AE8 D970"; } ];
   };
+  scientiac = {
+    email = "iac@scientiac.space";
+    name = "Spandan Guragain";
+    github = "scientiac";
+    githubId = 58177655;
+  };
   scm2342 = {
     name = "Sven Mattsen";
     email = "nix@sven.cc";
@@ -18194,6 +18215,12 @@
     githubId = 11587657;
     keys = [ { fingerprint = "E173 237A C782 296D 98F5  ADAC E13D FD4B 4712 7951"; } ];
   };
+  sdaqo = {
+    name = "sdaqo";
+    email = "sdaqo.dev@protonmail.com";
+    github = "sdaqo";
+    githubId = 63876564;
+  };
   sdht0 = {
     email = "nixpkgs@sdht.in";
     github = "sdht0";
@@ -21250,6 +21277,12 @@
     githubId = 245573;
     name = "Dmitry Kalinkin";
   };
+  vglfr = {
+    email = "vf.velt@gmail.com";
+    github = "vglfr";
+    githubId = 20283252;
+    name = "vglfr";
+  };
   vgskye = {
     name = "Skye Green";
     email = "me@skye.vg";
@@ -22195,6 +22228,12 @@
     githubId = 3705333;
     name = "Dmitry V.";
   };
+  yash-garg = {
+    email = "me@yashgarg.dev";
+    github = "yash-garg";
+    githubId = 33605526;
+    name = "Yash Garg";
+  };
   yavko = {
     name = "Yavor Kolev";
     email = "yavornkolev@gmail.com";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -133,6 +133,10 @@
 - The Invoiceplane module now only accepts the structured `settings` option.
   `extraConfig` is now removed.
 
+- The `ollama` services replaces its `sandbox` toggle with options to configure
+  a static `user` and `group`. The `writablePaths` option has been removed and
+  the models directory is now always exempt from sandboxing.
+
 - Legacy package `stalwart-mail_0_6` was dropped, please note the
   [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
   before changing the package to `pkgs.stalwart-mail` in

nixos/modules/module-list.nix

@@ -217,6 +217,7 @@
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
+  ./programs/kde-pim.nix
   ./programs/k40-whisperer.nix
   ./programs/kbdlight.nix
   ./programs/kclock.nix

nixos/modules/programs/appimage.nix

@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.programs.appimage;
@@ -18,16 +23,31 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    boot.binfmt.registrations.appimage = lib.mkIf cfg.binfmt {
-      wrapInterpreterInShell = false;
-      interpreter = lib.getExe cfg.package;
-      recognitionType = "magic";
-      offset = 0;
-      mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff'';
-      magicOrExtension = ''\x7fELF....AI\x02'';
-    };
+    boot.binfmt.registrations = lib.mkIf cfg.binfmt (
+      let
+        appimage_common = {
+          wrapInterpreterInShell = false;
+          interpreter = lib.getExe cfg.package;
+          recognitionType = "magic";
+          offset = 0;
+          mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff'';
+        };
+      in
+      {
+        appimage_type_1 = appimage_common // {
+          magicOrExtension = ''\x7fELF....AI\x01'';
+        };
+        appimage_type_2 = appimage_common // {
+          magicOrExtension = ''\x7fELF....AI\x02'';
+        };
+      }
+    );
     environment.systemPackages = [ cfg.package ];
   };
 
-  meta.maintainers = with lib.maintainers; [ jopejoe1 atemu ];
+  meta.maintainers = with lib.maintainers; [
+    jopejoe1
+    atemu
+    aleksana
+  ];
 }

nixos/modules/programs/kde-pim.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.programs.kde-pim;
+in
+{
+  options.programs.kde-pim = {
+    enable = lib.mkEnableOption "KDE PIM base packages";
+    kmail = lib.mkEnableOption "KMail";
+    kontact = lib.mkEnableOption "Kontact";
+    merkuro = lib.mkEnableOption "Merkuro";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs.kdePackages; [
+      # core packages
+      akonadi
+      kdepim-runtime
+    ] ++ lib.optionals cfg.kmail [
+      akonadiconsole
+      akonadi-search
+      kmail
+      kmail-account-wizard
+    ] ++ lib.optionals cfg.kontact [
+      kontact
+    ] ++ lib.optionals cfg.merkuro [
+      merkuro
+    ];
+  };
+}

nixos/modules/services/desktop-managers/plasma6.nix

@@ -213,6 +213,7 @@ in {
     };
 
     programs.gnupg.agent.pinentryPackage = mkDefault pkgs.pinentry-qt;
+    programs.kde-pim.enable = mkDefault true;
     programs.ssh.askPassword = mkDefault "${kdePackages.ksshaskpass.out}/bin/ksshaskpass";
 
     # Enable helpful DBus services.

nixos/modules/services/misc/ollama.nix

@@ -1,75 +1,76 @@
 { config, lib, pkgs, ... }:
 let
-  inherit (lib) types mkBefore;
+  inherit (lib) literalExpression types mkBefore;
 
   cfg = config.services.ollama;
   ollamaPackage = cfg.package.override {
     inherit (cfg) acceleration;
   };
+
+  staticUser = cfg.user != null && cfg.group != null;
 in
 {
   imports = [
     (lib.mkRemovedOptionModule [ "services" "ollama" "listenAddress" ]
       "Use `services.ollama.host` and `services.ollama.port` instead.")
+    (lib.mkRemovedOptionModule [ "services" "ollama" "sandbox" ]
+      "Set `services.ollama.user` and `services.ollama.group` instead.")
+    (lib.mkRemovedOptionModule [ "services" "ollama" "writablePaths" ]
+      "The `models` directory is now always writable. To make other directories writable, use `systemd.services.ollama.serviceConfig.ReadWritePaths`." )
   ];
 
   options = {
     services.ollama = {
       enable = lib.mkEnableOption "ollama server for local large language models";
       package = lib.mkPackageOption pkgs "ollama" { };
+
+      user = lib.mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "ollama";
+        description = ''
+          User account under which to run ollama. Defaults to [`DynamicUser`](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=)
+          when set to `null`.
+
+          The user will automatically be created, if this option is set to a non-null value.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = with types; nullOr str;
+        default = cfg.user;
+        defaultText = literalExpression "config.services.ollama.user";
+        example = "ollama";
+        description = ''
+          Group under which to run ollama. Only used when `services.ollama.user` is set.
+
+          The group will automatically be created, if this option is set to a non-null value.
+        '';
+      };
+
       home = lib.mkOption {
         type = types.str;
-        default = "%S/ollama";
+        default = "/var/lib/ollama";
         example = "/home/foo";
         description = ''
           The home directory that the ollama service is started in.
-
-          See also `services.ollama.writablePaths` and `services.ollama.sandbox`.
         '';
       };
+
       models = lib.mkOption {
         type = types.str;
-        default = "%S/ollama/models";
+        default = "${cfg.home}/models";
+        defaultText = "\${config.services.ollama.home}/models";
         example = "/path/to/ollama/models";
         description = ''
           The directory that the ollama service will read models from and download new models to.
-
-          See also `services.ollama.writablePaths` and `services.ollama.sandbox`
-          if downloading models or other mutation of the filesystem is required.
         '';
       };
-      sandbox = lib.mkOption {
-        type = types.bool;
-        default = true;
-        example = false;
-        description = ''
-          Whether to enable systemd's sandboxing capabilities.
 
-          This sets [`DynamicUser`](
-          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
-          ), which runs the server as a unique user with read-only access to most of the filesystem.
-
-          See also `services.ollama.writablePaths`.
-        '';
-      };
-      writablePaths = lib.mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        example = [ "/home/foo" "/mnt/foo" ];
-        description = ''
-          Paths that the server should have write access to.
-
-          This sets [`ReadWritePaths`](
-          https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ReadWritePaths=
-          ), which allows specified paths to be written to through the default sandboxing.
-
-          See also `services.ollama.sandbox`.
-        '';
-      };
       host = lib.mkOption {
         type = types.str;
         default = "127.0.0.1";
-        example = "0.0.0.0";
+        example = "[::]";
         description = ''
           The host address which the ollama server HTTP interface listens to.
         '';
@@ -149,6 +150,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    users = lib.mkIf staticUser  {
+      users.${cfg.user} = {
+        inherit (cfg) home;
+        isSystemUser = true;
+        group = cfg.group;
+      };
+      groups.${cfg.group} = {};
+    };
+
     systemd.services.ollama = {
       description = "Server for local large language models";
       wantedBy = [ "multi-user.target" ];
@@ -159,12 +169,63 @@ in
         OLLAMA_HOST = "${cfg.host}:${toString cfg.port}";
         HSA_OVERRIDE_GFX_VERSION = lib.mkIf (cfg.rocmOverrideGfx != null) cfg.rocmOverrideGfx;
       };
-      serviceConfig = {
+      serviceConfig = lib.optionalAttrs staticUser {
+        User = cfg.user;
+        Group = cfg.group;
+      } // {
+        DynamicUser = true;
         ExecStart = "${lib.getExe ollamaPackage} serve";
         WorkingDirectory = cfg.home;
         StateDirectory = [ "ollama" ];
-        DynamicUser = cfg.sandbox;
-        ReadWritePaths = cfg.writablePaths;
+        ReadWritePaths = [
+          cfg.home
+          cfg.models
+        ];
+
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [
+          # CUDA
+          # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+          "char-nvidiactl"
+          "char-nvidia-caps"
+          "char-nvidia-uvm"
+          # ROCm
+          "char-drm"
+          "char-kfd"
+        ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = false; # hides acceleration devices
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "all"; # /proc/meminfo
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        SupplementaryGroups = [ "render" ]; # for rocm to access /dev/dri/renderD* devices
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @resources"
+          "~@privileged"
+        ];
+        UMask = "0077";
       };
       postStart = mkBefore ''
         set -x

nixos/modules/services/misc/tandoor-recipes.nix

@@ -11,7 +11,6 @@ let
     DEBUG = "0";
     DEBUG_TOOLBAR = "0";
     MEDIA_ROOT = "/var/lib/tandoor-recipes";
-    GUNICORN_MEDIA = true;
   } // optionalAttrs (config.time.timeZone != null) {
     TZ = config.time.timeZone;
   } // (

nixos/modules/services/monitoring/scrutiny.nix

@@ -110,7 +110,10 @@ in
       };
 
       collector = {
-        enable = mkEnableOption "the Scrutiny metrics collector";
+        enable = mkEnableOption "the Scrutiny metrics collector" // {
+          default = cfg.enable;
+          defaultText = lib.literalExpression "config.services.scrutiny.enable";
+        };
 
         package = mkPackageOption pkgs "scrutiny-collector" { };
 

nixos/modules/services/networking/bind.nix

@@ -271,7 +271,8 @@ in
       '';
 
       serviceConfig = {
-        ExecStart = "${bindPkg.out}/sbin/named -u ${bindUser} ${optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} -f";
+        Type = "forking"; # Set type to forking, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900788
+        ExecStart = "${bindPkg.out}/sbin/named -u ${bindUser} ${optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile}";
         ExecReload = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' reload";
         ExecStop = "${bindPkg.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
       };

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -66,17 +66,17 @@ in
         enable = mkDefault true;
 
         # Taken from mint-artwork.gschema.override
-        theme = mkIf (notExcluded pkgs.cinnamon.mint-themes) {
+        theme = mkIf (notExcluded pkgs.mint-themes) {
           name = mkDefault "Mint-Y-Aqua";
-          package = mkDefault pkgs.cinnamon.mint-themes;
+          package = mkDefault pkgs.mint-themes;
         };
-        iconTheme = mkIf (notExcluded pkgs.cinnamon.mint-y-icons) {
+        iconTheme = mkIf (notExcluded pkgs.mint-y-icons) {
           name = mkDefault "Mint-Y-Sand";
-          package = mkDefault pkgs.cinnamon.mint-y-icons;
+          package = mkDefault pkgs.mint-y-icons;
         };
-        cursorTheme = mkIf (notExcluded pkgs.cinnamon.mint-cursor-themes) {
+        cursorTheme = mkIf (notExcluded pkgs.mint-cursor-themes) {
           name = mkDefault "Bibata-Modern-Classic";
-          package = mkDefault pkgs.cinnamon.mint-cursor-themes;
+          package = mkDefault pkgs.mint-cursor-themes;
         };
       };
 
@@ -101,10 +101,10 @@ in
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
-      services.dbus.packages = with pkgs.cinnamon; [
-        cinnamon-common
-        cinnamon-screensaver
-        nemo-with-extensions
+      services.dbus.packages = with pkgs; [
+        cinnamon.cinnamon-common
+        cinnamon.cinnamon-screensaver
+        cinnamon.nemo-with-extensions
         xapp
       ];
       services.cinnamon.apps.enable = mkDefault true;
@@ -134,21 +134,21 @@ in
         cinnamon-screensaver = {};
       };
 
-      environment.systemPackages = with pkgs.cinnamon // pkgs; ([
+      environment.systemPackages = with pkgs; ([
         desktop-file-utils
 
         # common-files
-        cinnamon-common
-        cinnamon-session
-        cinnamon-desktop
-        cinnamon-menus
-        cinnamon-translations
+        cinnamon.cinnamon-common
+        cinnamon.cinnamon-session
+        cinnamon.cinnamon-desktop
+        cinnamon.cinnamon-menus
+        cinnamon.cinnamon-translations
 
         # utils needed by some scripts
         killall
 
         # session requirements
-        cinnamon-screensaver
+        cinnamon.cinnamon-screensaver
         # cinnamon-killer-daemon: provided by cinnamon-common
         networkmanagerapplet # session requirement - also nm-applet not needed
 
@@ -156,10 +156,10 @@ in
         polkit_gnome
 
         # packages
-        nemo-with-extensions
+        cinnamon.nemo-with-extensions
         gnome-online-accounts-gtk
-        cinnamon-control-center
-        cinnamon-settings-daemon
+        cinnamon.cinnamon-control-center
+        cinnamon.cinnamon-settings-daemon
         libgnomekbd
 
         # theme
@@ -233,7 +233,7 @@ in
       programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome-terminal);
       programs.file-roller.enable = mkDefault (notExcluded pkgs.file-roller);
 
-      environment.systemPackages = with pkgs // pkgs.cinnamon; utils.removePackagesByName [
+      environment.systemPackages = with pkgs; utils.removePackagesByName [
         # cinnamon team apps
         bulky
         warpinator

nixos/modules/system/boot/binfmt.nix

@@ -141,6 +141,10 @@ let
       magicOrExtension = ''\x00asm'';
       mask = ''\xff\xff\xff\xff'';
     };
+    s390x-linux = {
+      magicOrExtension = ''\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x16'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
     x86_64-windows.magicOrExtension = "MZ";
     i686-windows.magicOrExtension = "MZ";
   };

nixos/modules/system/boot/systemd/sysusers.nix

@@ -5,6 +5,8 @@ let
   cfg = config.systemd.sysusers;
   userCfg = config.users;
 
+  systemUsers = lib.filterAttrs (_username: opts: !opts.isNormalUser) userCfg.users;
+
   sysusersConfig = pkgs.writeTextDir "00-nixos.conf" ''
     # Type Name ID GECOS Home directory Shell
 
@@ -16,7 +18,7 @@ let
         in
           ''u ${username} ${uid}:${opts.group} "${opts.description}" ${opts.home} ${utils.toShellPath opts.shell}''
       )
-      userCfg.users)
+      systemUsers)
     }
 
     # Groups
@@ -30,32 +32,12 @@ let
     }
   '';
 
-  staticSysusersCredentials = pkgs.runCommand "static-sysusers-credentials" { } ''
-    mkdir $out; cd $out
-    ${lib.concatLines (
-      (lib.mapAttrsToList
-        (username: opts: "echo -n '${opts.initialHashedPassword}' > 'passwd.hashed-password.${username}'")
-        (lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
-        ++
-      (lib.mapAttrsToList
-        (username: opts: "echo -n '${opts.initialPassword}' > 'passwd.plaintext-password.${username}'")
-        (lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
-        ++
-      (lib.mapAttrsToList
-        (username: opts: "cat '${opts.hashedPasswordFile}' > 'passwd.hashed-password.${username}'")
-        (lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users))
-      )
-    }
-  '';
-
-  staticSysusers = pkgs.runCommand "static-sysusers"
-    {
-      nativeBuildInputs = [ pkgs.systemd ];
-    } ''
-    mkdir $out
-    export CREDENTIALS_DIRECTORY=${staticSysusersCredentials}
-    systemd-sysusers --root $out ${sysusersConfig}/00-nixos.conf
-  '';
+  immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
+  # The location of the password files when using an immutable /etc.
+  immutablePasswordFilesLocation = "/var/lib/nixos/etc";
+  passwordFilesLocation = if immutableEtc then immutablePasswordFilesLocation else "/etc";
+  # The filenames created by systemd-sysusers.
+  passwordFiles = [ "passwd" "group" "shadow" "gshadow" ];
 
 in
 
@@ -90,95 +72,114 @@ in
         assertion = config.users.mutableUsers -> config.system.etc.overlay.enable;
         message = "config.users.mutableUsers requires config.system.etc.overlay.enable.";
       }
-    ];
-
-    systemd = lib.mkMerge [
-      ({
-
-        # Create home directories, do not create /var/empty even if that's a user's
-        # home.
-        tmpfiles.settings.home-directories = lib.mapAttrs'
-          (username: opts: lib.nameValuePair opts.home {
-            d = {
-              mode = opts.homeMode;
-              user = username;
-              group = opts.group;
-            };
-          })
-          (lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
-
-        # Create uid/gid marker files for those without an explicit id
-        tmpfiles.settings.nixos-uid = lib.mapAttrs'
-          (username: opts: lib.nameValuePair "/var/lib/nixos/uid/${username}" {
-            f = {
-              user = username;
-            };
-          })
-          (lib.filterAttrs (_username: opts: opts.uid == null) userCfg.users);
-
-        tmpfiles.settings.nixos-gid = lib.mapAttrs'
-          (groupname: opts: lib.nameValuePair "/var/lib/nixos/gid/${groupname}" {
-            f = {
-              group = groupname;
-            };
-          })
-          (lib.filterAttrs (_groupname: opts: opts.gid == null) userCfg.groups);
+    ] ++ (lib.mapAttrsToList
+      (_username: opts: {
+        assertion = !opts.isNormalUser;
+        message = "systemd-sysusers doesn't create normal users. You can currently only use it to create system users.";
       })
+      userCfg.users)
+    ++ lib.mapAttrsToList
+      (username: opts: {
+        assertion = (opts.password == opts.initialPassword || opts.password == null) &&
+          (opts.hashedPassword == opts.initialHashedPassword || opts.hashedPassword == null);
+        message = "${username} uses password or hashedPassword. systemd-sysupdate only supports initial passwords. It'll never update your passwords.";
+      })
+      systemUsers;
 
-      (lib.mkIf config.users.mutableUsers {
-        additionalUpstreamSystemUnits = [
-          "systemd-sysusers.service"
-        ];
+    systemd = {
 
-        services.systemd-sysusers = {
-          # Enable switch-to-configuration to restart the service.
-          unitConfig.ConditionNeedsUpdate = [ "" ];
-          requiredBy = [ "sysinit-reactivation.target" ];
-          before = [ "sysinit-reactivation.target" ];
-          restartTriggers = [ "${config.environment.etc."sysusers.d".source}" ];
-
-          serviceConfig = {
-            LoadCredential = lib.mapAttrsToList
-              (username: opts: "passwd.hashed-password.${username}:${opts.hashedPasswordFile}")
-              (lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) userCfg.users);
-            SetCredential = (lib.mapAttrsToList
-              (username: opts: "passwd.hashed-password.${username}:${opts.initialHashedPassword}")
-              (lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) userCfg.users))
-            ++
-            (lib.mapAttrsToList
-              (username: opts: "passwd.plaintext-password.${username}:${opts.initialPassword}")
-              (lib.filterAttrs (_username: opts: opts.initialPassword != null) userCfg.users))
-            ;
+      # Create home directories, do not create /var/empty even if that's a user's
+      # home.
+      tmpfiles.settings.home-directories = lib.mapAttrs'
+        (username: opts: lib.nameValuePair opts.home {
+          d = {
+            mode = opts.homeMode;
+            user = username;
+            group = opts.group;
           };
+        })
+        (lib.filterAttrs (_username: opts: opts.home != "/var/empty") systemUsers);
+
+      # Create uid/gid marker files for those without an explicit id
+      tmpfiles.settings.nixos-uid = lib.mapAttrs'
+        (username: opts: lib.nameValuePair "/var/lib/nixos/uid/${username}" {
+          f = {
+            user = username;
+          };
+        })
+        (lib.filterAttrs (_username: opts: opts.uid == null) systemUsers);
+
+      tmpfiles.settings.nixos-gid = lib.mapAttrs'
+        (groupname: opts: lib.nameValuePair "/var/lib/nixos/gid/${groupname}" {
+          f = {
+            group = groupname;
+          };
+        })
+        (lib.filterAttrs (_groupname: opts: opts.gid == null) userCfg.groups);
+
+      additionalUpstreamSystemUnits = [
+        "systemd-sysusers.service"
+      ];
+
+      services.systemd-sysusers = {
+        # Enable switch-to-configuration to restart the service.
+        unitConfig.ConditionNeedsUpdate = [ "" ];
+        requiredBy = [ "sysinit-reactivation.target" ];
+        before = [ "sysinit-reactivation.target" ];
+        restartTriggers = [ "${config.environment.etc."sysusers.d".source}" ];
+
+        serviceConfig = {
+          # When we have an immutable /etc we cannot write the files directly
+          # to /etc so we write it to a different directory and symlink them
+          # into /etc.
+          #
+          # We need to explicitly list the config file, otherwise
+          # systemd-sysusers cannot find it when we also pass another flag.
+          ExecStart = lib.mkIf immutableEtc
+            [ "" "${config.systemd.package}/bin/systemd-sysusers --root ${builtins.dirOf immutablePasswordFilesLocation} /etc/sysusers.d/00-nixos.conf" ];
+
+          # Make the source files writable before executing sysusers.
+          ExecStartPre = lib.mkIf (!userCfg.mutableUsers)
+            (lib.map
+              (file: "-${pkgs.util-linux}/bin/umount ${passwordFilesLocation}/${file}")
+              passwordFiles);
+          # Make the source files read-only after sysusers has finished.
+          ExecStartPost = lib.mkIf (!userCfg.mutableUsers)
+            (lib.map
+              (file: "${pkgs.util-linux}/bin/mount --bind -o ro ${passwordFilesLocation}/${file} ${passwordFilesLocation}/${file}")
+              passwordFiles);
+
+          LoadCredential = lib.mapAttrsToList
+            (username: opts: "passwd.hashed-password.${username}:${opts.hashedPasswordFile}")
+            (lib.filterAttrs (_username: opts: opts.hashedPasswordFile != null) systemUsers);
+          SetCredential = (lib.mapAttrsToList
+            (username: opts: "passwd.hashed-password.${username}:${opts.initialHashedPassword}")
+            (lib.filterAttrs (_username: opts: opts.initialHashedPassword != null) systemUsers))
+          ++
+          (lib.mapAttrsToList
+            (username: opts: "passwd.plaintext-password.${username}:${opts.initialPassword}")
+            (lib.filterAttrs (_username: opts: opts.initialPassword != null) systemUsers))
+          ;
         };
-      })
-    ];
+      };
+
+    };
 
     environment.etc = lib.mkMerge [
-      (lib.mkIf (!userCfg.mutableUsers) {
-        "passwd" = {
-          source = "${staticSysusers}/etc/passwd";
-          mode = "0644";
-        };
-        "group" = {
-          source = "${staticSysusers}/etc/group";
-          mode = "0644";
-        };
-        "shadow" = {
-          source = "${staticSysusers}/etc/shadow";
-          mode = "0000";
-        };
-        "gshadow" = {
-          source = "${staticSysusers}/etc/gshadow";
-          mode = "0000";
-        };
-      })
-
-      (lib.mkIf userCfg.mutableUsers {
+      ({
         "sysusers.d".source = sysusersConfig;
       })
-    ];
 
+      # Statically create the symlinks to immutablePasswordFilesLocation when
+      # using an immutable /etc because we will not be able to do it at
+      # runtime!
+      (lib.mkIf immutableEtc (lib.listToAttrs (lib.map
+        (file: lib.nameValuePair file {
+          source = "${immutablePasswordFilesLocation}/${file}";
+          mode = "direct-symlink";
+        })
+        passwordFiles)))
+    ];
   };
 
   meta.maintainers = with lib.maintainers; [ nikstur ];

nixos/modules/virtualisation/nixos-containers.nix

@@ -842,8 +842,8 @@ in
             optionalAttrs containerConfig.autoStart
               {
                 wantedBy = [ "machines.target" ];
-                wants = [ "network.target" ];
-                after = [ "network.target" ];
+                wants = [ "network.target" ] ++ (map (i: "sys-subsystem-net-devices-${i}.device") cfg.interfaces);
+                after = [ "network.target" ] ++ (map (i: "sys-subsystem-net-devices-${i}.device") cfg.interfaces);
                 restartTriggers = [
                   containerConfig.path
                   config.environment.etc."${configurationDirectoryName}/${name}.conf".source

nixos/modules/virtualisation/proxmox-image.nix

@@ -243,18 +243,18 @@ with lib;
         }).overrideAttrs ( super: rec {
           # Check https://github.com/proxmox/pve-qemu/tree/master for the version
           # of qemu and patch to use
-          version = "8.1.5";
+          version = "9.0.0";
           src = pkgs.fetchurl {
             url = "https://download.qemu.org/qemu-${version}.tar.xz";
-            hash = "sha256-l2Ox7+xP1JeWtQgNCINRLXDLY4nq1lxmHMNoalIjKJY=";
+            hash = "sha256-MnCKxmww2MiSYz6paMdxwcdtWX1w3erSGg0izPOG2mk=";
           };
           patches = [
             # Proxmox' VMA tool is published as a particular patch upon QEMU
             "${pkgs.fetchFromGitHub {
               owner = "proxmox";
               repo = "pve-qemu";
-              rev = "71dd2d48f9122e60e4c0a8480122a27aab15dc70";
-              hash = "sha256-Q8AxNv4geDdlbVIWphRO5P3ESo0SGgvUpVPmPJzubJM=";
+              rev = "14afbdd55f04d250bd679ca1ad55d3f47cd9d4c8";
+              hash = "sha256-lSJQA5SHIHfxJvMLIID2drv2H43crTPMNIlIT37w9Nc=";
             }}/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch"
           ];
 

nixos/tests/activation/etc-overlay-immutable.nix

@@ -32,6 +32,18 @@
     with subtest("direct symlinks point to the target without indirection"):
       assert machine.succeed("readlink -n /etc/localtime") == "/etc/zoneinfo/Utc"
 
+    with subtest("Correct mode on the source password files"):
+      assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/passwd") == "644\n"
+      assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/group") == "644\n"
+      assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/shadow") == "0\n"
+      assert machine.succeed("stat -c '%a' /var/lib/nixos/etc/gshadow") == "0\n"
+
+    with subtest("Password files are symlinks to /var/lib/nixos/etc"):
+      assert machine.succeed("readlink -f /etc/passwd") == "/var/lib/nixos/etc/passwd\n"
+      assert machine.succeed("readlink -f /etc/group") == "/var/lib/nixos/etc/group\n"
+      assert machine.succeed("readlink -f /etc/shadow") == "/var/lib/nixos/etc/shadow\n"
+      assert machine.succeed("readlink -f /etc/gshadow") == "/var/lib/nixos/etc/gshadow\n"
+
     with subtest("switching to the same generation"):
       machine.succeed("/run/current-system/bin/switch-to-configuration test")
 

nixos/tests/all-tests.nix

@@ -398,7 +398,7 @@ in {
   guix = handleTest ./guix {};
   gvisor = handleTest ./gvisor.nix {};
   hadoop = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop; };
-  hadoop_3_2 = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop_3_2; };
+  hadoop_3_3 = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop_3_3; };
   hadoop2 = import ./hadoop { inherit handleTestOn; package=pkgs.hadoop2; };
   haka = handleTest ./haka.nix {};
   haste-server = handleTest ./haste-server.nix {};
@@ -408,6 +408,7 @@ in {
   headscale = handleTest ./headscale.nix {};
   healthchecks = handleTest ./web-apps/healthchecks.nix {};
   hbase2 = handleTest ./hbase.nix { package=pkgs.hbase2; };
+  hbase_2_5 = handleTest ./hbase.nix { package=pkgs.hbase_2_5; };
   hbase_2_4 = handleTest ./hbase.nix { package=pkgs.hbase_2_4; };
   hbase3 = handleTest ./hbase.nix { package=pkgs.hbase3; };
   hddfancontrol = handleTest ./hddfancontrol.nix {};

nixos/tests/bind.nix

@@ -22,7 +22,6 @@ import ./make-test-python.nix {
 
   testScript = ''
     machine.wait_for_unit("bind.service")
-    machine.wait_for_open_port(53)
     machine.succeed("host 192.168.0.1 127.0.0.1 | grep -qF ns.example.org")
   '';
 }

nixos/tests/hadoop/hadoop.nix

@@ -99,6 +99,7 @@ import ../make-test-python.nix ({ package, ... }: {
       };
 
       dn1 = { ... }: {
+        virtualisation.diskSize = 4096;
         services.hadoop = {
           inherit package coreSite hdfsSite;
           hdfs.datanode = {

nixos/tests/systemd-sysusers-immutable.nix

@@ -2,8 +2,8 @@
 
 let
   rootPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
-  normaloPassword = "$y$j9T$3aiOV/8CADAK22OK2QT3/0$67OKd50Z4qTaZ8c/eRWHLIM.o3ujtC1.n9ysmJfv639";
-  newNormaloPassword = "mellow";
+  sysuserPassword = "$y$j9T$3aiOV/8CADAK22OK2QT3/0$67OKd50Z4qTaZ8c/eRWHLIM.o3ujtC1.n9ysmJfv639";
+  newSysuserPassword = "mellow";
 in
 
 {
@@ -16,49 +16,48 @@ in
     systemd.sysusers.enable = true;
     users.mutableUsers = false;
 
-    # Override the empty root password set by the test instrumentation
-    users.users.root.hashedPasswordFile = lib.mkForce null;
-    users.users.root.initialHashedPassword = rootPassword;
-    users.users.normalo = {
-      isNormalUser = true;
-      initialHashedPassword = normaloPassword;
+
+    # Read this password file at runtime from outside the Nix store.
+    environment.etc."rootpw.secret".text = rootPassword;
+    # Override the empty root password set by the test instrumentation.
+    users.users.root.hashedPasswordFile = lib.mkForce "/etc/rootpw.secret";
+
+    users.users.sysuser = {
+      isSystemUser = true;
+      group = "wheel";
+      home = "/sysuser";
+      initialHashedPassword = sysuserPassword;
     };
 
     specialisation.new-generation.configuration = {
-      users.users.new-normalo = {
-        isNormalUser = true;
-        initialPassword = newNormaloPassword;
+      users.users.new-sysuser = {
+        isSystemUser = true;
+        group = "wheel";
+        home = "/new-sysuser";
+        initialPassword = newSysuserPassword;
       };
     };
   };
 
   testScript = ''
-    with subtest("Users are not created with systemd-sysusers"):
-      machine.fail("systemctl status systemd-sysusers.service")
-      machine.fail("ls /etc/sysusers.d")
-
-    with subtest("Correct mode on the password files"):
-      assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
-      assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
-      assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
-      assert machine.succeed("stat -c '%a' /etc/gshadow") == "0\n"
-
     with subtest("root user has correct password"):
       print(machine.succeed("getent passwd root"))
       assert "${rootPassword}" in machine.succeed("getent shadow root"), "root user password is not correct"
 
-    with subtest("normalo user is created"):
-      print(machine.succeed("getent passwd normalo"))
-      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
-      assert "${normaloPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+    with subtest("sysuser user is created"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert machine.succeed("stat -c '%U' /sysuser") == "sysuser\n"
+      assert "${sysuserPassword}" in machine.succeed("getent shadow sysuser"), "sysuser user password is not correct"
+
+    with subtest("Fail to add new user manually"):
+      machine.fail("useradd manual-sysuser")
 
 
     machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
 
 
-    with subtest("new-normalo user is created after switching to new generation"):
-      print(machine.succeed("getent passwd new-normalo"))
-      print(machine.succeed("getent shadow new-normalo"))
-      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
+    with subtest("new-sysuser user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-sysuser"))
+      assert machine.succeed("stat -c '%U' /new-sysuser") == "new-sysuser\n"
   '';
 }

nixos/tests/systemd-sysusers-mutable.nix

@@ -2,8 +2,8 @@
 
 let
   rootPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
-  normaloPassword = "hello";
-  newNormaloPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
+  sysuserPassword = "hello";
+  newSysuserPassword = "$y$j9T$p6OI0WN7.rSfZBOijjRdR.$xUOA2MTcB48ac.9Oc5fz8cxwLv1mMqabnn333iOzSA6";
 in
 
 {
@@ -24,15 +24,19 @@ in
     # Override the empty root password set by the test instrumentation
     users.users.root.hashedPasswordFile = lib.mkForce null;
     users.users.root.initialHashedPassword = rootPassword;
-    users.users.normalo = {
-      isNormalUser = true;
-      initialPassword = normaloPassword;
+    users.users.sysuser = {
+      isSystemUser = true;
+      group = "wheel";
+      home = "/sysuser";
+      initialPassword = sysuserPassword;
     };
 
     specialisation.new-generation.configuration = {
-      users.users.new-normalo = {
-        isNormalUser = true;
-        initialHashedPassword = newNormaloPassword;
+      users.users.new-sysuser = {
+        isSystemUser = true;
+        group = "wheel";
+        home = "/new-sysuser";
+        initialHashedPassword = newSysuserPassword;
       };
     };
   };
@@ -43,7 +47,7 @@ in
     with subtest("systemd-sysusers.service contains the credentials"):
       sysusers_service = machine.succeed("systemctl cat systemd-sysusers.service")
       print(sysusers_service)
-      assert "SetCredential=passwd.plaintext-password.normalo:${normaloPassword}" in sysusers_service
+      assert "SetCredential=passwd.plaintext-password.sysuser:${sysuserPassword}" in sysusers_service
 
     with subtest("Correct mode on the password files"):
       assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
@@ -55,17 +59,20 @@ in
       print(machine.succeed("getent passwd root"))
       assert "${rootPassword}" in machine.succeed("getent shadow root"), "root user password is not correct"
 
-    with subtest("normalo user is created"):
-      print(machine.succeed("getent passwd normalo"))
-      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
+    with subtest("sysuser user is created"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert machine.succeed("stat -c '%U' /sysuser") == "sysuser\n"
+
+    with subtest("Manually add new user"):
+      machine.succeed("useradd manual-sysuser")
 
 
     machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
 
 
-    with subtest("new-normalo user is created after switching to new generation"):
-      print(machine.succeed("getent passwd new-normalo"))
-      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
-      assert "${newNormaloPassword}" in machine.succeed("getent shadow new-normalo"), "new-normalo user password is not correct"
+    with subtest("new-sysuser user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-sysuser"))
+      assert machine.succeed("stat -c '%U' /new-sysuser") == "new-sysuser\n"
+      assert "${newSysuserPassword}" in machine.succeed("getent shadow new-sysuser"), "new-sysuser user password is not correct"
   '';
 }

pkgs/applications/audio/ingen/default.nix

@@ -1,29 +1,60 @@
-{ lib, stdenv, fetchgit, boost, ganv, glibmm, gtkmm2, libjack2, lilv
-, lv2, pkg-config, python3, raul, serd, sord, sratom
-, wafHook
-, suil
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  portaudio,
+  boost,
+  ganv,
+  gtkmm2,
+  libjack2,
+  lilv,
+  pkg-config,
+  python3,
+  raul,
+  sord,
+  sratom,
+  suil,
+  meson,
+  ninja,
 }:
 
-stdenv.mkDerivation  rec {
+stdenv.mkDerivation {
   pname = "ingen";
-  version = "unstable-2019-12-09";
-  name = "${pname}-${version}";
+  version = "0-unstable-2024-07-13";
 
-  src = fetchgit {
-    url = "https://gitlab.com/drobilla/ingen.git";
-    rev = "e32f32a360f2bf8f017ea347b6d1e568c0beaf68";
-    sha256 = "0wjn2i3j7jb0bmxymg079xpk4iplb91q0xqqnvnpvyldrr7gawlb";
-    deepClone = true;
+  src = fetchFromGitLab {
+    owner = "drobilla";
+    repo = "ingen";
+    rev = "bbdab98ed282291b6e29a944359c360c9cca127e";
+    hash = "sha256-BllWeVmEkHQaZD9Ba7H0JMRlxVROJ8pkIiC2VXYiweA=";
   };
 
-  nativeBuildInputs = [ pkg-config wafHook python3 python3.pkgs.wrapPython ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3
+    python3.pkgs.wrapPython
+  ];
+
   buildInputs = [
-    boost ganv glibmm gtkmm2 libjack2 lilv lv2
-    python3 raul serd sord sratom suil
+    boost
+    ganv
+    gtkmm2
+    libjack2
+    lilv
+    portaudio
+    raul
+    sord
+    sratom
+    suil
   ];
 
   strictDeps = true;
 
+  # lv2specgen.py is not packaged in lv2 but required to build docs
+  mesonFlags = [ "-Ddocs=disabled" ];
+
   pythonPath = [
     python3
     python3.pkgs.rdflib
@@ -31,13 +62,17 @@ stdenv.mkDerivation  rec {
 
   postInstall = ''
     wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
+    wrapProgram "$out/bin/ingen" --set INGEN_UI_PATH "$out/share/ingen/ingen_gui.ui"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Modular audio processing system using JACK and LV2 or LADSPA plugins";
     homepage = "http://drobilla.net/software/ingen";
-    license = licenses.agpl3Plus;
-    maintainers = [ maintainers.goibhniu ];
-    platforms = platforms.linux;
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [
+      goibhniu
+      t4ccer
+    ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/applications/audio/roomeqwizard/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roomeqwizard";
-  version = "5.31.1";
+  version = "5.31.2";
 
   src = fetchurl {
     url = "https://www.roomeqwizard.com/installers/REW_linux_no_jre_${lib.replaceStrings [ "." ] [ "_" ] version}.sh";
-    sha256 = "sha256-n1Ohja6Hpg/TNoxQKF1VCDkVj0UDCefr1x5ArIsgs2A=";
+    sha256 = "sha256-B4qP+qNNPMB/EkW/C2kfcx+h9YH8Md1lM9yUh5YT13s=";
   };
 
   dontUnpack = true;

pkgs/applications/audio/spotify/linux.nix

@@ -14,14 +14,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.37.701.ge66eb7bc";
+  version = "1.2.40.599.g606b7f29";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "76";
+  rev = "77";
 
   deps = [
     alsa-lib
@@ -88,7 +88,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     name = "spotify-${version}-${rev}.snap";
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-k7aw1QM3NCFkm0tXcHgYyeEBagGFpCL6JdWlFruJszPloiCy5vopOsD4PdqyiSEs0rSUP0rLxX2UBs3XuI5cUA==";
+    hash = "sha512-XQyZbU6dJh87jEdEvks2D0EpMkjPSKROl8kurSaiPs2z4FZ2SxM2DUvHwtKemKKScdTISm3jh6wyHXwPhB8eNQ==";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 makeShellWrapper squashfsTools ];

pkgs/applications/audio/tidal-hifi/default.nix

@@ -37,11 +37,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.14.1";
+  version = "5.15.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-3oVQyFtAFqlh4GOgavN2e2TVhCILg6Rhf5GZcot+aKo=";
+    sha256 = "sha256-0OXNynf56On+emLO0ZfNIcoT3GEhSXdoQhfxapLYYic=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];

pkgs/applications/blockchains/lnd/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.18.0-beta";
+  version = "0.18.2-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-LkVlsmL/NjWtKUnerqTiT/jNfxazYw0B0GhBDCTGmao=";
+    hash = "sha256-qqvLnJlFGeCizm6T9iUwvYLjWpAeZwbuzQlUUopwrjc=";
   };
 
-  vendorHash = "sha256-T7jPuhAEeQ0U43J9gTQ+0/BdLAn4BOupAkmmmofhHtY=";
+  vendorHash = "sha256-BxNtZzwmKJ/kZk7ndtEUC4bMGpd8LEhFFu4Z49bKydE=";
 
   subPackages = [ "cmd/lncli" "cmd/lnd" ];
 

pkgs/applications/display-managers/lightdm-slick-greeter/default.nix

@@ -7,7 +7,7 @@
 , python3
 , vala
 , wrapGAppsHook3
-, cinnamon
+, xapp
 , lightdm
 , gtk3
 , pixman
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lightdm-slick-greeter";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "slick-greeter";
     rev = version;
-    sha256 = "sha256-Q37CprukHvDRBcuPbfusKg2DY+JCwmjVX1+KnfSH2iw=";
+    sha256 = "sha256-Q6V4axKlGhX1/uaugNkjoynHSL5jWA/eqzAsbJYcRSo=";
   };
 
   nativeBuildInputs = [
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    cinnamon.xapp
+    xapp
     lightdm
     gtk3
     pixman

pkgs/applications/editors/emacs/build-support/elpa.nix

@@ -3,7 +3,7 @@
 { lib, stdenv, emacs, texinfo, writeText, gcc }:
 
 let
-  handledArgs = [ "files" "fileSpecs" "meta" ];
+  handledArgs = [ "meta" ];
   genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; };
 
 in

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -4,7 +4,8 @@
 
 let
   inherit (lib) optionalAttrs getLib;
-  handledArgs = [ "buildInputs" "packageRequires" "meta" ];
+  handledArgs = [ "buildInputs" "packageRequires" "propagatedUserEnvPkgs" "meta" ]
+    ++ lib.optionals (emacs.withNativeCompilation or false) [ "nativeBuildInputs" "postInstall" ];
 
   setupHook = writeText "setup-hook.sh" ''
     source ${./emacs-funcs.sh}
@@ -25,7 +26,10 @@ in
 { pname
 , version
 , buildInputs ? []
+, nativeBuildInputs ? []
 , packageRequires ? []
+, propagatedUserEnvPkgs ? []
+, postInstall ? ""
 , meta ? {}
 , turnCompilationWarningToError ? false
 , ignoreCompilationError ? true
@@ -53,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: ({
 
   buildInputs = [emacs texinfo] ++ packageRequires ++ buildInputs;
   propagatedBuildInputs = packageRequires;
-  propagatedUserEnvPkgs = packageRequires;
+  propagatedUserEnvPkgs = packageRequires ++ propagatedUserEnvPkgs;
 
   inherit setupHook;
 
@@ -71,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: ({
 
   LIBRARY_PATH = "${getLib stdenv.cc.libc}/lib";
 
-  nativeBuildInputs = [ gcc ];
+  nativeBuildInputs = [ gcc ] ++ nativeBuildInputs;
 
   addEmacsNativeLoadPath = true;
 
@@ -93,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: ({
              --eval '(setq byte-compile-error-on-warn ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"})' \
              -f batch-native-compile {} \
            || exit ${if finalAttrs.ignoreCompilationError then "0" else "\\$?"}"
-  '';
+  '' + postInstall;
 }
 
 // removeAttrs args handledArgs))

pkgs/applications/editors/emacs/build-support/melpa.nix

@@ -4,6 +4,7 @@
 { lib, stdenv, fetchFromGitHub, emacs, texinfo, writeText, gcc }:
 
 let
+  handledArgs = [ "meta" "preUnpack" "postUnpack" ];
   genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; };
 
   packageBuild = stdenv.mkDerivation {
@@ -65,6 +66,8 @@ in
     (${ename} :fetcher git :url ""
               ${lib.optionalString (files != null) ":files ${files}"})
   '')
+, preUnpack ? ""
+, postUnpack ? ""
 , meta ? {}
 , ...
 }@args:
@@ -98,12 +101,12 @@ genericBuild ({
     ln -s "$packageBuild" "$NIX_BUILD_TOP/package-build"
 
     mkdir -p "$NIX_BUILD_TOP/packages"
-  '';
+  '' + preUnpack;
 
   postUnpack = ''
     mkdir -p "$NIX_BUILD_TOP/working"
     ln -s "$NIX_BUILD_TOP/$sourceRoot" "$NIX_BUILD_TOP/working/$ename"
-  '';
+  '' + postUnpack;
 
   buildPhase = ''
     runHook preBuild
@@ -140,4 +143,4 @@ genericBuild ({
   } // meta;
 }
 
-// removeAttrs args [ "meta" ])
+// removeAttrs args handledArgs)

pkgs/applications/editors/emacs/elisp-packages/manual-packages/acm-terminal/default.nix

@@ -1,55 +1,34 @@
-{ lib
-, melpaBuild
-, fetchFromGitHub
-, acm
-, popon
-, writeText
-, writeScript
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  acm,
+  popon,
+  unstableGitUpdater,
 }:
 
-let
-  rev = "1851d8fa2a27d3fd8deeeb29cd21c3002b8351ba";
-in
 melpaBuild {
   pname = "acm-terminal";
-  version = "20231206.1141";
+  version = "0-unstable-2023-12-06";
 
   src = fetchFromGitHub {
     owner = "twlz0ne";
     repo = "acm-terminal";
-    inherit rev;
-    sha256 = "sha256-EYhFrOo0j0JSNTdcZCbyM0iLxaymUXi1u6jZy8lTOaY=";
+    rev = "1851d8fa2a27d3fd8deeeb29cd21c3002b8351ba";
+    hash = "sha256-EYhFrOo0j0JSNTdcZCbyM0iLxaymUXi1u6jZy8lTOaY=";
   };
 
-  commit = rev;
-
   packageRequires = [
     acm
     popon
   ];
 
-  recipe = writeText "recipe" ''
-    (acm-terminal :repo "twlz0ne/acm-terminal" :fetcher github)
-  '';
+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
 
-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts coreutils git gnused
-    set -eu -o pipefail
-    tmpdir="$(mktemp -d)"
-    git clone --depth=1 https://github.com/twlz0ne/acm-terminal.git "$tmpdir"
-    pushd "$tmpdir"
-    commit=$(git show -s --pretty='format:%H')
-    # Based on: https://github.com/melpa/melpa/blob/2d8716906a0c9e18d6c979d8450bf1d15dd785eb/package-build/package-build.el#L523-L533
-    version=$(TZ=UTC git show -s --pretty='format:%cd' --date='format-local:%Y%m%d.%H%M' | sed 's|\.0*|.|')
-    popd
-    update-source-version emacsPackages.acm-terminal $version --rev="$commit"
-  '';
-
-  meta = with lib; {
-    description = "Patch for LSP bridge acm on Terminal";
+  meta = {
     homepage = "https://github.com/twlz0ne/acm-terminal";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ kira-bruneau ];
+    description = "Patch for LSP bridge acm on Terminal";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ kira-bruneau ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/color-theme-solarized/default.nix

@@ -1,10 +1,11 @@
-{ lib
-, trivialBuild
-, fetchFromGitHub
-, color-theme
+{
+  lib,
+  color-theme,
+  fetchFromGitHub,
+  melpaBuild,
 }:
 
-trivialBuild {
+melpaBuild {
   pname = "color-theme-solarized";
   version = "0-unstable-2017-10-24";
 
@@ -17,10 +18,10 @@ trivialBuild {
 
   packageRequires = [ color-theme ];
 
-  meta = with lib; {
+  meta = {
     homepage = "http://ethanschoonover.com/solarized";
     description = "Precision colors for machines and people; Emacs implementation";
-    license = licenses.mit;
-    maintainers = with maintainers; [ samuelrivas AndersonTorres ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-conflict/default.nix

@@ -1,10 +1,10 @@
-{ lib
-, fetchFromGitHub
-, trivialBuild
-, emacs
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
 }:
 
-trivialBuild {
+melpaBuild {
   pname = "emacs-conflict";
   version = "0-unstable-2022-11-21";
 
@@ -12,14 +12,13 @@ trivialBuild {
     owner = "ibizaman";
     repo = "emacs-conflict";
     rev = "9f236b93930f3ceb4cb0258cf935c99599191de3";
-    sha256 = "sha256-DIGvnotSQYIgHxGxtyCALHd8ZbrfkmdvjLXlkcqQ6v4=";
+    hash = "sha256-DIGvnotSQYIgHxGxtyCALHd8ZbrfkmdvjLXlkcqQ6v4=";
   };
 
-  meta = with lib; {
-    description = "Resolve conflicts happening when using file synchronization tools";
+  meta = {
     homepage = "https://github.com/ibizaman/emacs-conflict";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ ibizaman ];
-    inherit (emacs.meta) platforms;
+    description = "Resolve conflicts happening when using file synchronization tools";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ibizaman ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/evil-markdown/default.nix

@@ -1,12 +1,12 @@
-{ lib
-, trivialBuild
-, fetchFromGitHub
-, emacs
-, evil
-, markdown-mode
+{
+  lib,
+  evil,
+  fetchFromGitHub,
+  markdown-mode,
+  melpaBuild,
 }:
 
-trivialBuild rec {
+melpaBuild {
   pname = "evil-markdown";
   version = "0-unstable-2021-07-21";
 
@@ -17,18 +17,15 @@ trivialBuild rec {
     hash = "sha256-HBBuZ1VWIn6kwK5CtGIvHM1+9eiNiKPH0GUsyvpUVN8=";
   };
 
-  buildInputs = propagatedUserEnvPkgs;
-
-  propagatedUserEnvPkgs = [
+  packageRequires = [
     evil
     markdown-mode
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/Somelauw/evil-markdown";
     description = "Integrates Emacs evil and markdown";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ leungbk ];
-    inherit (emacs.meta) platforms;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ leungbk ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/default.nix

@@ -1,10 +1,10 @@
-{ lib
-, fetchFromGitHub
-, emacs
-, trivialBuild
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
 }:
 
-trivialBuild {
+melpaBuild {
   pname = "git-undo";
   version = "0-unstable-2019-12-21";
 
@@ -12,14 +12,13 @@ trivialBuild {
     owner = "jwiegley";
     repo = "git-undo-el";
     rev = "cf31e38e7889e6ade7d2d2b9f8719fd44f52feb5";
-    sha256 = "sha256-cVkK9EF6qQyVV3uVqnBEjF8e9nEx/8ixnM8PvxqCyYE=";
+    hash = "sha256-cVkK9EF6qQyVV3uVqnBEjF8e9nEx/8ixnM8PvxqCyYE=";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/jwiegley/git-undo-el";
     description = "Revert region to most recent Git-historical version";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ leungbk ];
-    inherit (emacs.meta) platforms;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ leungbk ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/grid/default.nix

@@ -6,7 +6,7 @@
 
 melpaBuild {
   pname = "grid";
-  version = "20240526.1305";
+  version = "0-unstable-2024-05-26";
 
   src = fetchFromGitHub {
     owner = "ichernyshovvv";

pkgs/applications/editors/emacs/elisp-packages/manual-packages/helm-words/default.nix

@@ -1,28 +1,30 @@
-{ lib
-, trivialBuild
-, fetchFromGitHub
-, dictionary
-, emacs
-, helm
+{
+  lib,
+  dictionary,
+  fetchFromGitHub,
+  helm,
+  melpaBuild,
 }:
 
-trivialBuild rec {
+melpaBuild {
   pname = "helm-words";
   version = "0-unstable-2019-03-12";
 
   src = fetchFromGitHub {
     owner = "emacsmirror";
-    repo = pname;
+    repo = "helm-words";
     rev = "e6387ece1940a06695b9d910de3d90252efb8d29";
     hash = "sha256-rh8YKDLZZCUE6JnnRnFyDDyUjK+35+M2dkawR/+qwNM=";
   };
 
-  packageRequires = [ helm dictionary ];
+  packageRequires = [
+    dictionary
+    helm
+  ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/emacsmirror/helm-words";
     description = "Helm extension for looking up words in dictionaries and thesauri";
-    license = licenses.gpl3Plus;
-    inherit (emacs.meta) platforms;
+    license = lib.licenses.gpl3Plus;
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/idris2-mode/default.nix

@@ -1,32 +1,29 @@
-{ lib
-, trivialBuild
-, fetchFromGitHub
-, emacs
-, prop-menu
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
+  prop-menu,
 }:
 
-trivialBuild rec {
+melpaBuild rec {
   pname = "idris2-mode";
   version = "1.1";
 
   src = fetchFromGitHub {
     owner = "idris-community";
-    repo = pname;
+    repo = "idris2-mode";
     rev = version;
     hash = "sha256-rTeVjkAw44Q35vjaERs4uoZRJ6XR3FKplEUCVPHhY7Q=";
   };
 
-  buildInputs = propagatedUserEnvPkgs;
-
-  propagatedUserEnvPkgs = [
+  packageRequires = [
     prop-menu
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/idris-community/idris2-mode";
-    description = "This is an emacs mode for editing Idris 2 code";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wuyoli ];
-    inherit (emacs.meta) platforms;
+    description = "Emacs mode for editing Idris 2 code";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ wuyoli ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/pod-mode/default.nix

@@ -1,18 +1,35 @@
-{ trivialBuild, lib, fetchurl }:
+{
+  lib,
+  melpaBuild,
+  fetchurl
+}:
 
-trivialBuild rec {
+let
   pname = "pod-mode";
   version = "1.04";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/F/FL/FLORA/pod-mode-${version}.tar.gz";
-    sha256 = "1wr0khymkaa65blrc5nya607c1a3sjsww49bbf8f0a6176as71sv";
+    hash = "sha256-W4ejlTnBKOCQWysRzrXUQwV2gFHeFpbpKkapWT2cIPM=";
   };
+in
+melpaBuild {
+  inherit pname version src;
 
-  meta = with lib; {
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  postInstall = ''
+    mkdir -p ''${!outputDoc}/share/doc/pod-mode/
+    install -Dm644 -t ''${!outputDoc}/share/doc/pod-mode/ $sourceRoot/ChangeLog $sourceRoot/README
+  '';
+
+  meta = {
+    homepage = "https://metacpan.org/dist/pod-mode";
     description = "Major mode for editing .pod-files";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ qyliss ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ qyliss ];
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/default.nix

@@ -1,21 +1,22 @@
-{ trivialBuild
-, lib
-, fetchFromGitHub
-, avy
-, json-rpc-server
-, f
-, nav-flash
-, helm
-, cl-lib
-, porthole
-, default-text-scale
-, bind-key
-, yasnippet
-, company
-, company-quickhelp
+{
+  lib,
+  avy,
+  bind-key,
+  cl-lib,
+  company,
+  company-quickhelp,
+  default-text-scale,
+  f,
+  fetchFromGitHub,
+  helm,
+  json-rpc-server,
+  melpaBuild,
+  nav-flash,
+  porthole,
+  yasnippet,
 }:
 
-trivialBuild {
+melpaBuild {
   pname = "voicemacs";
   version = "0-unstable-2022-02-16";
 
@@ -23,28 +24,29 @@ trivialBuild {
     owner = "jcaw";
     repo = "voicemacs";
     rev = "d91de2a31c68ab083172ade2451419d6bd7bb389";
-    sha256 = "sha256-/MBB2R9/V0aYZp15e0vx+67ijCPp2iPlgxe262ldmtc=";
+    hash = "sha256-/MBB2R9/V0aYZp15e0vx+67ijCPp2iPlgxe262ldmtc=";
   };
 
-  patches = [ ./add-missing-require.patch ];
+  patches = [ ./0000-add-missing-require.patch ];
 
   packageRequires = [
     avy
-    json-rpc-server
-    f
-    nav-flash
-    helm
-    cl-lib
-    porthole
-    default-text-scale
     bind-key
-    yasnippet
+    cl-lib
+    company
     company-quickhelp
+    default-text-scale
+    f
+    helm
+    json-rpc-server
+    nav-flash
+    porthole
+    yasnippet
   ];
 
   meta = {
-    description = "Voicemacs is a set of utilities for controlling Emacs by voice";
+    homepage = "https://github.com/jcaw/voicemacs/";
+    description = "Set of utilities for controlling Emacs by voice";
     license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/wat-mode/default.nix

@@ -1,9 +1,8 @@
-# Manually packaged until it is upstreamed to melpa
-# See https://github.com/devonsparks/wat-mode/issues/1
 {
   lib,
   melpaBuild,
   fetchFromGitHub,
+  unstableGitUpdater,
 }:
 
 melpaBuild {
@@ -17,6 +16,8 @@ melpaBuild {
     hash = "sha256-jV5V3TRY+D3cPSz3yFwVWn9yInhGOYIaUTPEhsOBxto=";
   };
 
+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
   meta = {
     homepage = "https://github.com/devonsparks/wat-mode";
     description = "Emacs major mode for WebAssembly's text format";

pkgs/applications/editors/emacs/elisp-packages/manual-packages/youtube-dl/default.nix

@@ -1,10 +1,10 @@
-{ lib
-, fetchFromGitHub
-, trivialBuild
-, emacs
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
 }:
 
-trivialBuild {
+melpaBuild {
   pname = "youtube-dl";
   version = "1.0-unstable-2018-10-12";
 
@@ -12,14 +12,13 @@ trivialBuild {
     owner = "skeeto";
     repo = "youtube-dl-emacs";
     rev = "af877b5bc4f01c04fccfa7d47a2c328926f20ef4";
-    sha256 = "sha256-Etl95rcoRACDPjcTPQqYK2L+w8OZbOrTrRT0JadMdH4=";
+    hash = "sha256-Etl95rcoRACDPjcTPQqYK2L+w8OZbOrTrRT0JadMdH4=";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Emacs youtube-dl download manager";
     homepage = "https://github.com/skeeto/youtube-dl-emacs";
-    license = licenses.unlicense;
-    maintainers = with maintainers; [ leungbk ];
-    inherit (emacs.meta) platforms;
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ leungbk ];
   };
 }

pkgs/applications/editors/neovim/wrapper.nix

@@ -201,7 +201,7 @@ let
       };
     };
 
-    meta = neovim-unwrapped.meta // {
+    meta = (builtins.removeAttrs neovim-unwrapped.meta ["position" "outputsToInstall"]) // {
       # To prevent builds on hydra
       hydraPlatforms = [];
       # prefer wrapper over the package

pkgs/applications/editors/vim/plugins/generated.nix

@@ -4403,6 +4403,18 @@ final: prev:
     meta.homepage = "https://github.com/blazkowolf/gruber-darker.nvim/";
   };
 
+  grug-far-nvim = buildVimPlugin {
+    pname = "grug-far.nvim";
+    version = "2024-07-22";
+    src = fetchFromGitHub {
+      owner = "MagicDuck";
+      repo = "grug-far.nvim";
+      rev = "f9a8592b037b761fac6a327bc314e9e3eb47401e";
+      sha256 = "13aa8s9lxdjiyifj9vmbph6hl9px0spfm36my1j2h41biq5nsx5q";
+    };
+    meta.homepage = "https://github.com/MagicDuck/grug-far.nvim/";
+  };
+
   gruvbox = buildVimPlugin {
     pname = "gruvbox";
     version = "2023-08-14";
@@ -5963,18 +5975,6 @@ final: prev:
     meta.homepage = "https://github.com/mkasa/lushtags/";
   };
 
-  lz-n = buildNeovimPlugin {
-    pname = "lz.n";
-    version = "2024-07-10";
-    src = fetchFromGitHub {
-      owner = "nvim-neorocks";
-      repo = "lz.n";
-      rev = "3d36b6848fc67f6a13d2a52cf4f96fd3403c0c43";
-      sha256 = "11ic8hylck3dvlp6d9kzblingbi167j2kcid155x4hpc2hhqf2aj";
-    };
-    meta.homepage = "https://github.com/nvim-neorocks/lz.n/";
-  };
-
   magma-nvim-goose = buildVimPlugin {
     pname = "magma-nvim-goose";
     version = "2023-07-04";
@@ -6950,6 +6950,18 @@ final: prev:
     meta.homepage = "https://github.com/nvim-neotest/neotest-go/";
   };
 
+  neotest-golang = buildVimPlugin {
+    pname = "neotest-golang";
+    version = "2024-07-17";
+    src = fetchFromGitHub {
+      owner = "fredrikaverpil";
+      repo = "neotest-golang";
+      rev = "f6657d875e9046e2f215c5480c62105dd8002f94";
+      sha256 = "1xsizbmryhac8iw7r8zs4mjycakzanq5bfdpfcl289d52rl92y0l";
+    };
+    meta.homepage = "https://github.com/fredrikaverpil/neotest-golang/";
+  };
+
   neotest-gradle = buildVimPlugin {
     pname = "neotest-gradle";
     version = "2023-12-05";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -549,6 +549,53 @@
     patches = [ ./patches/coq_nvim/emulate-venv.patch ];
   };
 
+  cord-nvim =
+    let
+      version = "2024-07-19";
+      src = fetchFromGitHub {
+        owner = "vyfor";
+        repo = "cord.nvim";
+        rev = "cd97c25320fb0a672b11bcd95d8332bb3088ecce";
+        hash = "sha256-66NtKteM1mvHP5wAU4e9JbsF+bq91lmCDcTh/6RPhoo=";
+      };
+      extension = if stdenv.isDarwin then "dylib" else "so";
+      rustPackage = rustPlatform.buildRustPackage {
+        pname = "cord.nvim-rust";
+        inherit version src;
+
+        cargoSha256 = "sha256-6FYf4pHEPxvhKHHPmkjQ40zPxaiypnpDxF8kNH+h+tg=";
+
+        installPhase = let
+          cargoTarget = stdenv.hostPlatform.rust.cargoShortTarget;
+        in ''
+          install -D target/${cargoTarget}/release/libcord.${extension} $out/lib/cord.${extension}
+        '';
+      };
+    in
+    buildVimPlugin {
+      pname = "cord.nvim";
+      inherit version src;
+
+      nativeBuildInputs = [
+        rustPackage
+      ];
+
+      buildPhase = ''
+        install -D ${rustPackage}/lib/cord.${extension} cord.${extension}
+      '';
+
+      installPhase = ''
+        install -D cord $out/lua/cord.${extension}
+      '';
+
+      doInstallCheck = true;
+      nvimRequireCheck = "cord";
+
+      meta = {
+        homepage = "https://github.com/vyfor/cord.nvim";
+      };
+    };
+
   cornelis = super.cornelis.overrideAttrs {
     dependencies = with self; [ vim-textobj-user ];
     opt = with self; [ vim-which-key ];
@@ -617,7 +664,7 @@
   };
 
   deoplete-go = super.deoplete-go.overrideAttrs {
-    buildInputs = [ python3 ];
+    nativeBuildInputs = [ (python3.withPackages (ps: with ps; [ setuptools ])) ];
     buildPhase = ''
       pushd ./rplugin/python3/deoplete/ujson
       python3 setup.py build --build-base=$PWD/build --build-lib=$PWD/build
@@ -941,6 +988,8 @@
     dependencies = with self; [ luaPackages.jsregexp ];
   };
 
+  lz-n = neovimUtils.buildNeovimPlugin { luaAttr = "lz-n"; };
+
   magma-nvim-goose = buildVimPlugin {
     pname = "magma-nvim-goose";
     version = "2023-03-13";
@@ -1087,6 +1136,10 @@
     dependencies = [ self.telescope-nvim ];
   };
 
+  neotest-golang = super.neotest-golang.overrideAttrs {
+    dependencies = [ self.nvim-dap-go ];
+  };
+
   neo-tree-nvim = super.neo-tree-nvim.overrideAttrs {
     dependencies = with self; [ plenary-nvim nui-nvim ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -366,6 +366,7 @@ https://github.com/brymer-meneses/grammar-guard.nvim/,HEAD,
 https://github.com/liuchengxu/graphviz.vim/,,
 https://github.com/cbochs/grapple.nvim/,HEAD,
 https://github.com/blazkowolf/gruber-darker.nvim/,,
+https://github.com/MagicDuck/grug-far.nvim/,,
 https://github.com/gruvbox-community/gruvbox/,,gruvbox-community
 https://github.com/morhetz/gruvbox/,,
 https://github.com/luisiacc/gruvbox-baby/,HEAD,
@@ -499,7 +500,6 @@ https://github.com/l3mon4d3/luasnip/,,
 https://github.com/alvarosevilla95/luatab.nvim/,,
 https://github.com/rktjmp/lush.nvim/,,
 https://github.com/mkasa/lushtags/,,
-https://github.com/nvim-neorocks/lz.n/,,
 https://github.com/WhiteBlackGoose/magma-nvim-goose/,HEAD,
 https://github.com/winston0410/mark-radar.nvim/,HEAD,
 https://github.com/iamcco/markdown-preview.nvim/,,
@@ -583,6 +583,7 @@ https://github.com/Issafalcon/neotest-dotnet/,HEAD,
 https://github.com/jfpedroza/neotest-elixir/,HEAD,
 https://github.com/llllvvuu/neotest-foundry/,HEAD,
 https://github.com/nvim-neotest/neotest-go/,HEAD,
+https://github.com/fredrikaverpil/neotest-golang/,HEAD,
 https://github.com/weilbith/neotest-gradle/,HEAD,
 https://github.com/alfaix/neotest-gtest/,HEAD,
 https://github.com/MrcJkb/neotest-haskell/,HEAD,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1782,8 +1782,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.2";
-          hash = "sha256-S3R1oLk7facP5Rn9czmHlffhMtLNrSaGYbaU3/x6/aM=";
+          version = "0.7.4";
+          hash = "sha256-6nU0bVAe/vwq43ECLwypIkMAG/q5+P2bE1RPAjeTCX4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-ekbk4nBigsBOW5bc2ETVCygFjLFqZgLNMbFKprb1HqE=";
+    hash = "sha256-AB+jLcY9VfJgqcbh8PEZ9nRiJPv4EcSG1arSeW6dCBo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/gnome-obfuscate/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitLab
+, buildPackages
 , cargo
 , gettext
 , meson
@@ -36,6 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9lrxK2psdIPGsOC6p8T+3AGPrX6PjrK9mFirdJqBSMM=";
   };
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    # Set the location to gettext to ensure the nixpkgs one on Darwin instead of the vendored one.
+    # The vendored gettext does not build with clang 16.
+    GETTEXT_BIN_DIR = "${lib.getBin buildPackages.gettext}/bin";
+    GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
+    GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
+  };
+
   nativeBuildInputs = [
     gettext
     meson

pkgs/applications/misc/cherrytree/default.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Xtm+SFJOSb04WlooRhTopYtyiXEOkOmiPojM8E7l5vY=";
+    hash = "sha256-JiSGoEVGotaPqEKFHjTagi+sZPgdX+tKI0FIHRmJKHE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/far2l/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "far2l";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "elfmz";
     repo = "far2l";
     rev = "v_${version}";
-    sha256 = "sha256-fFwO06edv2f/remnKc5snAjgmqveVNqxHiUcTlfe+4Y=";
+    sha256 = "sha256-rX+r5l6dOKZPeiOIdWVPlux5yu5TsuRNCfv3PmNvJWI=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config m4 perl makeWrapper ];

pkgs/applications/misc/fuzzel/default.nix

@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://codeberg.org/dnkl/fuzzel";
     license = with licenses; [ mit zlib ];
     mainProgram = "fuzzel";
-    maintainers = with maintainers; [ fionera polykernel rodrgz ];
+    maintainers = with maintainers; [ fionera rodrgz ];
     platforms = with platforms; linux;
   };
 })

pkgs/applications/misc/rivercarro/default.nix

@@ -1,23 +1,24 @@
 { lib
 , stdenv
+, callPackage
 , fetchFromSourcehut
 , pkg-config
 , river
 , wayland
 , wayland-protocols
-, zig_0_11
+, zig_0_12
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rivercarro";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromSourcehut {
     owner = "~novakane";
     repo = "rivercarro";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-lucwn9MmyVd4pynuG/ZAXnZ384wdS0gi7JN44vNQA1I=";
+    hash = "sha256-nDKPv/roweW7ynEROsipUJPvs6VMmz3E4JzEFRBzE6s=";
   };
 
   nativeBuildInputs = [
@@ -25,9 +26,13 @@ stdenv.mkDerivation (finalAttrs: {
     river
     wayland
     wayland-protocols
-    zig_0_11.hook
+    zig_0_12.hook
   ];
 
+  postPatch = ''
+    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
+  '';
+
   meta = with lib; {
     homepage = "https://git.sr.ht/~novakane/rivercarro";
     description = "Layout generator for river Wayland compositor, fork of rivertile";
@@ -44,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://git.sr.ht/~novakane/rivercarro/refs/v${finalAttrs.version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kraem ];
-    inherit (zig_0_11.meta) platforms;
+    inherit (zig_0_12.meta) platforms;
     mainProgram = "rivercarro";
   };
 })

pkgs/applications/misc/rivercarro/deps.nix

@@ -0,0 +1,13 @@
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
+{ linkFarm, fetchzip }:
+
+linkFarm "zig-packages" [
+  {
+    name = "1220b0f8f822c1625af7aae4cb3ab2c4ec1a4c0e99ef32867b2a8d88bb070b3e7f6d";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.1.0.tar.gz";
+      hash = "sha256-VLEx8nRgmJZWgLNBRqrR7bZEkW0m5HTRv984HKwoIfA=";
+    };
+  }
+]

pkgs/applications/misc/sticky/default.nix

@@ -6,7 +6,7 @@
 , ninja
 , python3
 , wrapGAppsHook3
-, cinnamon
+, xapp
 , glib
 , gspell
 , gtk3
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    cinnamon.xapp
+    xapp
     glib
     gspell
     gtk3
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
 
   pythonPath = with python3.pkgs; [
     pygobject3
-    xapp
+    python-xapp
   ];
 
   dontWrapGApps = true;

pkgs/applications/networking/cluster/atlantis/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "atlantis";
-  version = "0.28.3";
+  version = "0.28.5";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     rev = "v${version}";
-    hash = "sha256-azbzBHDDS705ocgUX/oNcmsnhNKJppQB1CRh60CCj58=";
+    hash = "sha256-oyECtP/YeEhvsltWZq52YNq+Gbbpko9bbbUTh5NA/9c=";
   };
   ldflags = [
     "-X=main.version=${version}"

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -125,6 +125,24 @@ in
 {
   # Different version of hadoop support different java runtime versions
   # https://cwiki.apache.org/confluence/display/HADOOP/Hadoop+Java+Versions
+  hadoop_3_4 = common rec {
+    pname = "hadoop";
+    platformAttrs = rec {
+      x86_64-linux = {
+        version = "3.4.0";
+        hash = "sha256-4xGnhIBBQDD57GNUml1oXmnibyBxA9mr8hpIud0DyGw=";
+        srcHash = "sha256-viDF3LdRCZHqFycOYfN7nUQBPHiMCIjmu7jgIAaaK9E=";
+      };
+      x86_64-darwin = x86_64-linux;
+      aarch64-linux = x86_64-linux // {
+        hash = "sha256-QWxzKtNyw/AzcHMv0v7kj91pw1HO7VAN9MHO84caFk8=";
+      };
+      aarch64-darwin = aarch64-linux;
+    };
+    jdk = jdk11_headless;
+    # TODO: Package and add Intel Storage Acceleration Library
+    tests = nixosTests.hadoop;
+  };
   hadoop_3_3 = common rec {
     pname = "hadoop";
     platformAttrs = rec {
@@ -141,17 +159,7 @@ in
     };
     jdk = jdk11_headless;
     # TODO: Package and add Intel Storage Acceleration Library
-    tests = nixosTests.hadoop;
-  };
-  hadoop_3_2 = common {
-    pname = "hadoop";
-    platformAttrs.x86_64-linux = {
-      version = "3.2.4";
-      hash = "sha256-qt2gpMr+NHuiVR+/zFRzRyRKG725/ZNBIM69z9J9wNw=";
-      srcHash = "sha256-F9nGD3mZZ1eJf3Ec3AJGE9YBcL/HiagskcdKQhCn/sw=";
-    };
-    jdk = jdk8_headless;
-    tests = nixosTests.hadoop_3_2;
+    tests = nixosTests.hadoop_3_3;
   };
   hadoop2 = common rec {
     pname = "hadoop";

pkgs/applications/networking/cluster/k3s/1_28/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.28.11+k3s1";
-  k3sCommit = "617b0e84f419e37ba995c6dec06ccfbb24bd649c";
-  k3sRepoSha256 = "04pmg0qx1sidpkv72vllmnk82v4fg490gvppp79m3jc931v059w9";
-  k3sVendorHash = "sha256-6uCzObYCIETT/aswsHR9hOzUPNZe8GJbLWfNqOKWyag=";
+  k3sVersion = "1.28.11+k3s2";
+  k3sCommit = "d076d9a78cb835279a04f12c816ff4404884862e";
+  k3sRepoSha256 = "1k1k3qmxc7n2h2i0g52ad4gnpq0qrvxnl7p2y0g9dss1ancgqwsd";
+  k3sVendorHash = "sha256-tzcMcsTmY8lG+9EyYkzYJm1YU/8tGpxpH7oZ4Jl/yNU=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.12.2";
   k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";

pkgs/applications/networking/cluster/nomad-driver-podman/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nomad-driver-podman";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cM/bu8d39mY85XtHJNIp9h0U3kzviSe87c2CQs9vVTA=";
+    sha256 = "sha256-aD5Sh2/4juHzeB64Sl0Zpioq9TLIA9PUOf6Gk98W+Js=";
   };
 
-  vendorHash = "sha256-BdCcFR5vWXbZ+yumRdpozfuB3fqzVifErRQ7RAfdco8=";
+  vendorHash = "sha256-ILfH2QXQIM/ybSAXqmRYe99HmgZ18wuCHQUrZf1GS2Y=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.12.3";
+  version = "4.12.5";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     rev = "v${version}";
-    hash = "sha256-861WEzUc2tVa4HcX5E5KsXcLsX4EgINiC/s+r8ZsCAI=";
+    hash = "sha256-xNbCKRAHs9xiZMLbsV6vcu8ga7WaGqZ+Dg4itTmRRr4=";
   };
 
-  vendorHash = "sha256-+JGYntDnFdGN7YfYstbssIXdLn16/Rx0jzbYT646DTY=";
+  vendorHash = "sha256-Zq/98A3FiOPySXqY83rboC39cLcwrk6AvBk8+XIPrT8=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -2,52 +2,52 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.59";
-      ptb = "0.0.93";
-      canary = "0.0.450";
-      development = "0.0.22";
+      stable = "0.0.60";
+      ptb = "0.0.95";
+      canary = "0.0.453";
+      development = "0.0.23";
     } else {
-      stable = "0.0.310";
-      ptb = "0.0.122";
-      canary = "0.0.559";
-      development = "0.0.44";
+      stable = "0.0.311";
+      ptb = "0.0.124";
+      canary = "0.0.562";
+      development = "0.0.45";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-wv0HcbPlFRb8OTvnkCdb1MAuvl/7LHTUfE5UxpeSIPw=";
+        hash = "sha256-hu1+/z/ZtHoobjHF+pgNm040r4LQJUTnpZ06RNERFr8=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-MO940dRAJ0J/fa8I+nU8483AH8PA7eIJ9ZUF15iqbgE=";
+        hash = "sha256-AtGfukiFT07i655wW4/9p6NHkjtgHlE9rSp6owXhT5k=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-qKg27ysy3kUAPL5YrB2BKu5FCwXMfQZtDUT23Yge5No=";
+        hash = "sha256-yEU/3PfS1uQklVVcO7p/xAJTM3RPz88bSxMIajeDTUM=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-dSoi/YZra8SRbV1rvbtKkyHmhfTb+A6mja8zZ9Y5JNo=";
+        hash = "sha256-dLHfiWih2e0pFVglQgViZ3As+fCPIfWHIgl5Nv34Iug=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-zQ4/S2BpQDuU3ReKaNh31DRHS4S6FFUo6Y6YjGB1/mE=";
+        hash = "sha256-k/PEywycex/3Z+QRgM13vGoIf33vSeaZPbBwdETPsvE=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-DckRIoLKmAqUtdXUvvSKeNZUq/77Acy0Np0fPhQjUa4=";
+        hash = "sha256-6OVcvDo4fTpuT/dq8zphSITwuw4DMdFNCnCdi7wqvpQ=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-HrgWpmqyn4k3DDM/LE4JUN6DeJKklm7kzyry4ZiL7pA=";
+        hash = "sha256-MxV2RZkDbio78Od8lEvJHEoKEN4xxSSie8QuviCUjSk=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-Ryk43s8peXIvifcrxeot2nIGpqOfpgWKmVEYQkuX4I0=";
+        hash = "sha256-KvomKLcDnHyRSGwKDxwb5AZbJqMwKpvP4BC0Sn7IVsk=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/instant-messengers/gomuks/default.nix

@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "gomuks";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gLyjqmGZudj8PmsYUGXHOjetZzi6u5CFI7Y50y2XAzk=";
+    sha256 = "sha256-bDJXo8d9K5UO599HDaABpfwc9/dJJy+9d24KMVZHyvI=";
   };
 
-  vendorHash = "sha256-FmQJG6hv0YPyHVjZ/DvkQExrGLc1hjoiPS59MnqG2gU=";
+  vendorHash = "sha256-0my58bVKLWbdTwhAnXMruNjujd07NXFn4bkRe1cUYpE=";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix

@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.16.0-beta.1";
+  version = "7.17.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-FaQhinUylZesX0gIFA1CynirLRxOw2P0IdZBjEPEo1U=";
+  hash = "sha256-sK42Bqh+j4b8SduZk6eMhgBhRMG0q/ee5lAqFYVc4Tg=";
 }

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix

@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.15.0";
+  version = "7.16.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-UgWVxLOqul/XsM++1Cai7+skjByQfGDO8gBVDJNv/tw=";
+  hash = "sha256-DfPQb3TGhVVZ7webNoMmyhjhRKKO3lWf12ZIpi7D7tc=";
 }

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240715-2";
+  version = "20240718-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-QyukKuRoF6TWFa73EaOO429u9AF+1NCKsLjwQT/fD6U=";
+    hash = "sha256-FqBKyIRxeRVGxKtBfBO0XX57VzW0XuSKZSLurHh3JNM=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/sky/default.nix

@@ -1,67 +0,0 @@
-{ lib
-, mkDerivation
-, fetchurl
-, autoPatchelfHook
-, zstd
-, curl
-, ffmpeg
-, libjpeg_turbo
-, libpam-wrapper
-, libv4l
-, pulseaudio
-, zlib
-, xorg
-}:
-
-mkDerivation rec {
-  pname = "sky";
-  version = "2.1.7801";
-
-  src = fetchurl {
-    url = "https://tel.red/repos/archlinux/sky-archlinux-${version}-1-x86_64.pkg.tar.zst";
-    sha256 = "sha256-3xiq2b3CwNjRd09q0z8olrmLGhgkJGAVkZoJSIHom+k=";
-  };
-
-  nativeBuildInputs = [ autoPatchelfHook zstd ];
-
-  buildInputs = [
-    curl
-    ffmpeg
-    libjpeg_turbo
-    libpam-wrapper
-    libv4l
-    pulseaudio
-    xorg.libX11
-    xorg.libXScrnSaver
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXinerama
-    xorg.libXmu
-    xorg.libXrandr
-    xorg.libXtst
-    xorg.libXv
-    xorg.libxkbfile
-    zlib
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir $out
-    mv * $out/
-    ln --force --symbolic $out/lib/sky/sky{,_sender} $out/bin
-    substituteInPlace $out/share/applications/sky.desktop \
-      --replace /usr/ $out/
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Lync & Skype for Business on Linux";
-    homepage = "https://tel.red/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.wucke13 ];
-    platforms = [ "x86_64-linux" ];
-  };
-}

pkgs/applications/networking/irc/weechat/default.nix

@@ -36,14 +36,14 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "4.3.4";
+      version = "4.3.5";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-        hash = "sha256-ytRYAi9GmRILfXLgYrNGxNDng1nMl4X6LhaG/XS6f2c=";
+        hash = "sha256-5tvEyDLaXFuF5Jb+/BUjf7viqPe6L76B7gcdwMZrS+M=";
       };
 
       # Why is this needed? https://github.com/weechat/weechat/issues/2031

pkgs/applications/networking/remote/freerdp/3.nix

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.6.0";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-wGfktzy8vrhTZE0ZG+gtsXsCmarXFs/yHcnZFeoFHGY=";
+    hash = "sha256-LdgHQ2lb3cde4cX4aIwHvSo0q9iwpLzaWDHbv1/rneE=";
   };
 
   postPatch = ''

pkgs/applications/networking/seaweedfs/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.69";
+  version = "3.71";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-stbp4SqBXTZv5QXDwslsg/Y4lhkPGbwcslWZTR3c2v0=";
+    hash = "sha256-urYpcFZtZCEQ6nGcDJ2gq+HYnMcEencVn/jxt0HUl/U=";
   };
 
-  vendorHash = "sha256-OfLC7a2+YM95F/anrwvhTw4mc72ogBZfLEPDUKMn9IE=";
+  vendorHash = "sha256-2YvIK0wIwCELcaBUZN2SbTngdFO717YY+83NSIzae0w=";
 
   subPackages = [ "weed" ];
 

pkgs/applications/office/paperless-ngx/default.nix

@@ -24,13 +24,13 @@
 }:
 
 let
-  version = "2.10.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LwWdgoVlZjL5o+T8zzU9jkYaQbdiZokrCGn8ZTIQ4OQ=";
+    hash = "sha256-lKPjvWc6FcEOwDgIUW8Eki8h8C19G618o1rhXnrlw/E=";
   };
 
   # subpath installation is broken with uvicorn >= 0.26
@@ -50,18 +50,6 @@ let
           hash = "sha256-ng98DTw49zyFjrPnEwfnPfONyjKKZYuLl0qduxSppYk=";
         };
       });
-
-      djangorestframework = prev.djangorestframework.overridePythonAttrs (oldAttrs: rec {
-        version = "3.14.0";
-        src = oldAttrs.src.override {
-          rev = version;
-          hash = "sha256-Fnj0n3NS3SetOlwSmGkLE979vNJnYE6i6xwVBslpNz4=";
-        };
-        nativeCheckInputs = with prev; [
-          pytest7CheckHook
-          pytest-django
-        ];
-      });
     };
   };
 
@@ -86,7 +74,7 @@ let
       cd src-ui
     '';
 
-    npmDepsHash = "sha256-zmlYwlH2cnGbbKf6jt5zBLh0Iv3C9/xN0iA4xVetRNE=";
+    npmDepsHash = "sha256-gbHavMUmsZaRSfBkdrrNpTO0R8zacb8110U8n5Y09oU=";
 
     nativeBuildInputs = [
       pkg-config
@@ -231,6 +219,7 @@ python.pkgs.buildPythonApplication rec {
     pytest-django
     pytest-env
     pytest-httpx
+    pytest-mock
     pytest-rerunfailures
     pytest-xdist
     pytestCheckHook

pkgs/applications/office/planify/default.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.8.4";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-iQo7ETz5j/Uy5a96XFRkZ0U67dTHWEYLsr/qUi79Y4E=";
+    hash = "sha256-zNQe0w8Vbe+ZIYTer1ISwJ6yA4dOdDtuWme5txcbY3w=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/qownnotes/default.nix

@@ -21,14 +21,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.7.1";
+  version = "24.7.2";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-U/ZTpQEoYfiyBBBnfSjPriYlaiCxvmitT7N+OXQXlv4=";
+    hash = "sha256-MzZxZ6n0TQ6ZDAdJRIwg7pyrxf/Y5iS/4mRUkg3jzH4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch

@@ -0,0 +1,66 @@
+From: Stephane Glondu <steph@glondu.net>
+Date: Wed, 12 Feb 2020 05:42:32 +0100
+Subject: Fix compilation with camlp5 7.11
+
+---
+ pa_j_4.xx_7.xx.ml | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/pa_j_4.xx_7.xx.ml b/pa_j_4.xx_7.xx.ml
+index 4f7ed60..e834058 100755
+--- a/pa_j/pa_j_4.xx_7.xx.ml
++++ b/pa_j/pa_j_4.xx_7.xx.ml
+@@ -410,9 +410,10 @@ and reloc_module_type floc sh =
+     | MtApp loc x1 x2 →
+         let loc = floc loc in
+         MtApp loc (self x1) (self x2)
+-    | MtFun loc x1 x2 x3 →
++    | MtFun loc x x3 →
+         let loc = floc loc in
+-        MtFun loc x1 (self x2) (self x3)
++        let x = vala_map (option_map (fun (x1, x2) -> (x1, self x2))) x in
++        MtFun loc x (self x3)
+     | MtLid loc x1 →
+         let loc = floc loc in
+         MtLid loc x1
+@@ -507,9 +508,10 @@ and reloc_module_expr floc sh =
+     | MeApp loc x1 x2 →
+         let loc = floc loc in
+         MeApp loc (self x1) (self x2)
+-    | MeFun loc x1 x2 x3 →
++    | MeFun loc x x3 →
+         let loc = floc loc in
+-        MeFun loc x1 (reloc_module_type floc sh x2) (self x3)
++        let x = vala_map (option_map (fun (x1, x2) -> (x1, reloc_module_type floc sh x2))) x in
++        MeFun loc x (self x3)
+     | MeStr loc x1 →
+         let loc = floc loc in
+         MeStr loc (vala_map (List.map (reloc_str_item floc sh)) x1)
+@@ -2007,7 +2009,7 @@ EXTEND
+       | -> <:vala< [] >> ] ]
+   ;
+   mod_binding:
+-    [ [ i = V UIDENT; me = mod_fun_binding -> (i, me) ] ]
++    [ [ i = V uidopt "uidopt"; me = mod_fun_binding -> (i, me) ] ]
+   ;
+   mod_fun_binding:
+     [ RIGHTA
+@@ -2070,7 +2072,7 @@ EXTEND
+           <:sig_item< value $lid:i$ : $t$ >> ] ]
+   ;
+   mod_decl_binding:
+-    [ [ i = V UIDENT; mt = module_declaration -> (i, mt) ] ]
++    [ [ i = V uidopt "uidopt"; mt = module_declaration -> (i, mt) ] ]
+   ;
+   module_declaration:
+     [ RIGHTA
+@@ -2092,6 +2094,9 @@ EXTEND
+       | "module"; i = V mod_ident ""; ":="; me = module_expr ->
+           <:with_constr< module $_:i$ := $me$ >> ] ]
+   ;
++  uidopt:
++    [ [ m = V UIDENT -> Some m ] ]
++  ;
+   (* Core expressions *)
+   expr:
+     [ "top" RIGHTA

pkgs/applications/science/logic/hol_light/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, runtimeShell, fetchFromGitHub, fetchpatch, ocaml, findlib, num, zarith, camlp5, camlp-streams }:
+{ lib, stdenv, runtimeShell, fetchFromGitHub, ocaml, findlib, num, zarith, camlp5, camlp-streams }:
 
 let
   use_zarith = lib.versionAtLeast ocaml.version "4.14";
@@ -28,21 +28,16 @@ in
 
 stdenv.mkDerivation {
   pname = "hol_light";
-  version = "unstable-2024-05-10";
+  version = "unstable-2024-07-07";
 
   src = fetchFromGitHub {
     owner = "jrh13";
     repo = "hol-light";
-    rev = "d8366986e22555c4e4c8ff49667d646d15c35f14";
-    hash = "sha256-dN9X7yQlFof759I5lxxL4DxDe8V3XAhCRaryO9NabY4=";
+    rev = "16b184e30e7e3fe9add7d1ee93242323ed2e1726";
+    hash = "sha256-V0OtsmX5pa+CH3ZXmNG3juXwXZ5+A0k13eMCAfaRziQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://salsa.debian.org/ocaml-team/hol-light/-/raw/master/debian/patches/0004-Fix-compilation-with-camlp5-7.11.patch";
-      sha256 = "180qmxbrk3vb1ix7j77hcs8vsar91rs11s5mm8ir5352rz7ylicr";
-    })
-  ];
+  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
 
   strictDeps = true;
 

pkgs/applications/science/math/mxnet/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     name = "apache-mxnet-src-${version}-incubating.tar.gz";
-    url = "https://dlcdn.apache.org/incubator/mxnet/${version}/apache-mxnet-src-${version}-incubating.tar.gz";
+    url = "mirror://apache/incubator/mxnet/${version}/apache-mxnet-src-${version}-incubating.tar.gz";
     hash = "sha256-EephMoF02MKblvNBl34D3rC/Sww3rOZY+T442euMkyI=";
   };
 

pkgs/applications/science/math/numworks-epsilon/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numworks-epsilon";
-  version = "23.2.2";
+  version = "23.2.3";
 
   src = fetchFromGitHub {
     owner = "numworks";
     repo = "epsilon";
     rev = version;
-    hash = "sha256-XyKi0IMvXDOYgF7e8nU14sE5YuJPTTfkZnoWZOoJdC0=";
+    hash = "sha256-w9ddcULE1MrGnYcXA0qOg1elQv/eBhcXqhMSjWT3Bkk=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/version-management/stgit/default.nix

@@ -18,15 +18,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stgit";
-  version = "2.4.7";
+  version = "2.4.8";
 
   src = fetchFromGitHub {
     owner = "stacked-git";
     repo = "stgit";
     rev = "v${version}";
-    hash = "sha256-TfCmVN7oHOgMyreJo58r6qaQYAXqmekpZt2WyTMGLvQ=";
+    hash = "sha256-9eMHYI7p81WidLjtwJzjBcyURoqbHmQvsWpwS+1Wqo0=";
   };
-  cargoHash = "sha256-kH7YrjoNkpoUdzcWtVqpWtmw+FIMrJYbo0ye30/VeVk=";
+  cargoHash = "sha256-kvD7dz23SIqH/N9RY3s+iivocUJVWJWzIII2jMSh5og=";
 
   nativeBuildInputs = [
     pkg-config installShellFiles makeWrapper asciidoc xmlto docbook_xsl

pkgs/applications/video/bino3d/default.nix

@@ -1,26 +1,55 @@
-{ mkDerivation, lib, fetchurl, pkg-config, ffmpeg_4, glew, libass, openal, qtbase }:
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  ninja,
+  pkg-config,
+  pandoc,
+  wrapQtAppsHook,
+  qtbase,
+  qtmultimedia,
+  qttools,
+}:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bino";
-  version = "1.6.8";
+  version = "2.2";
 
-  src = fetchurl {
-    url = "https://bino3d.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8sIdX+qm7CGPHIziFBHHIe+KEbhbwDY6w/iRm1V+so4=";
+  src = fetchgit {
+    url = "https://git.marlam.de/git/bino.git";
+    rev = "bino-${finalAttrs.version}";
+    hash = "sha256-t7bkpYOswGEjUg+k2gjUkWwZJjj44KIVrEQs5P4DoSI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    pandoc
+    wrapQtAppsHook
+  ];
 
-  buildInputs = [ ffmpeg_4 glew libass openal qtbase ];
+  buildInputs = [
+    qtbase
+    qtmultimedia
+    qttools
+    # The optional QVR dependency is not currently packaged.
+  ];
 
-  enableParallelBuilding = true;
+  # LTO is currently broken on macOS.
+  # https://github.com/NixOS/nixpkgs/issues/19098
+  cmakeFlags = lib.optionals stdenv.isDarwin [
+    (lib.cmakeBool "CMAKE_INTERPROCEDURAL_OPTIMIZATION_RELEASE" false)
+  ];
 
-  meta = with lib; {
-    description = "Stereoscopic 3D and multi-display video player";
+  meta = {
+    description = "Video player with a focus on 3D and Virtual Reality";
     homepage = "https://bino3d.org/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ orivej ];
-    platforms = platforms.linux;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.orivej ];
+    platforms = lib.platforms.unix;
     mainProgram = "bino";
   };
-}
+})

pkgs/applications/video/hypnotix/default.nix

@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , substituteAll
-, cinnamon
+, xapp
 , circle-flags
 , gettext
 , gobject-introspection
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hypnotix";
-  version = "4.5";
+  version = "4.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "hypnotix";
     rev = version;
-    hash = "sha256-tcBBPJr9C+3FC8VWAM+KzETKAovfyehBvlmn7mIR7VQ=";
+    hash = "sha256-wDzHCrZTbfIb9dpRoh5qYKQNjONOv34FYdOr4svOLEw=";
   };
 
   patches = [
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   dontWrapGApps = true;
 
   buildInputs = [
-    cinnamon.xapp
+    xapp
     python3 # for patchShebangs
   ];
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     requests
     setproctitle
     unidecode
-    xapp
+    python-xapp
   ];
 
   installPhase = ''

pkgs/applications/video/kodi/addons/pdfreader/default.nix

@@ -2,13 +2,13 @@
 buildKodiAddon rec {
   pname = "pdfreader";
   namespace = "plugin.image.pdf";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "i96751414";
     repo = "plugin.image.pdfreader";
     rev = "v${version}";
-    sha256 = "0nkqhlm1gyagq6xpdgqvd5qxyr2ngpml9smdmzfabc8b972mwjml";
+    sha256 = "sha256-J93poR5VO9fAgNCEGftJVYnpXOsJSxnhHI6TAJZ2LeI=";
   };
 
   passthru.pythonPath = "lib/api";

pkgs/applications/video/multiviewer-for-f1/default.nix

@@ -23,15 +23,15 @@
 , xorg
 }:
 let
-  id = "168727396";
+  id = "180492850";
 in
 stdenvNoCC.mkDerivation rec {
   pname = "multiviewer-for-f1";
-  version = "1.32.1";
+  version = "1.35.2";
 
   src = fetchurl {
     url = "https://releases.multiviewer.dev/download/${id}/multiviewer-for-f1_${version}_amd64.deb";
-    sha256 = "sha256-cnfye5c3+ZYZLjlZ6F4OD90tXhxDbgbNBn98mgmZ+Hs=";
+    sha256 = "sha256-V1+kMgfbgDS47YNIotmzrh2Hry5pvdQvrzWwuKJY1oM=";
   };
 
   nativeBuildInputs = [
@@ -100,4 +100,3 @@ stdenvNoCC.mkDerivation rec {
     mainProgram = "multiviewer-for-f1";
   };
 }
-

pkgs/applications/video/vdr/default.nix

@@ -5,12 +5,12 @@
 }: stdenv.mkDerivation rec {
 
   pname = "vdr";
-  version = "2.6.8";
+  version = "2.6.9";
 
   src = fetchgit {
     url = "git://git.tvdr.de/vdr.git";
     rev = version;
-    hash = "sha256-Q6m/0Px4wLkd1GOKLFFRBVywYoIBh6W1BHh3pbtmgfU=";
+    hash = "sha256-0Metur3+fQhomf+ClY9zXijNsr5wWkaqnzjUNXjsjss=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/virtualization/colima/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7kaZ55Uhvx8V75IgURD03fLoAd/O/+2h/7tv9XiqnX4=";
+    hash = "sha256-gXLKqSmlj3TJNmqYuByJ2CcUCV3xD239YeuWzrN97lo=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-FPcz109zQBHaS/bIl78rVeiEluR1PhrJhgs21Ex6qEg=";
+  vendorHash = "sha256-OXK6ZHKghKxgETjY3mg1R2yp8pPpy5yV8M4K+Hh9Fjw=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log

pkgs/applications/virtualization/ecs-agent/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.85.0";
+  version = "1.85.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-IP1kZ2hSe1IJBNVYybZa+PYav3gHQayNyin3aOQCJS8=";
+    hash = "sha256-TrfFJ6N1DreO3NcznXBcNZziESAMxWa4FR+KzDjRDmM=";
   };
 
   vendorHash = null;

pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix

@@ -1,48 +1,41 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, cmake
-, pkg-config
-, wayland-scanner
-, makeWrapper
-, wrapQtAppsHook
-, hyprland-protocols
-, hyprlang
-, libdrm
-, mesa
-, pipewire
-, qtbase
-, qttools
-, qtwayland
-, sdbus-cpp
-, systemd
-, wayland
-, wayland-protocols
-, hyprland
-, hyprpicker
-, slurp
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  pkg-config,
+  wayland-scanner,
+  makeWrapper,
+  wrapQtAppsHook,
+  nix-update-script,
+  hyprland-protocols,
+  hyprlang,
+  libdrm,
+  mesa,
+  pipewire,
+  qtbase,
+  qttools,
+  qtwayland,
+  sdbus-cpp,
+  systemd,
+  wayland,
+  wayland-protocols,
+  hyprland,
+  hyprpicker,
+  slurp,
 }:
-stdenv.mkDerivation (self: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
-    rev = "v${self.version}";
-    hash = "sha256-KsX7sAwkEFpXiwyjt0HGTnnrUU58wW1jlzj5IA/LRz8=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cyyxu/oj4QEFp3CVx2WeXa9T4OAUyynuBJHGkBZSxJI=";
   };
 
-  patches = [
-    # TODO: remove on next upgrade
-    (fetchpatch {
-      name = "fix-compilation-pipewire-1.2.0.patch";
-      url = "https://github.com/hyprwm/xdg-desktop-portal-hyprland/commit/c5b30938710d6c599f3f5cd99a3ffac35381fb0f.patch";
-      hash = "sha256-f9OgW9tLuGuHXYH6bR1Y+CEuBPHOhRiHfEPebJzlwK8=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -71,18 +64,33 @@ stdenv.mkDerivation (self: {
   postInstall = ''
     wrapProgramShell $out/bin/hyprland-share-picker \
       "''${qtWrapperArgs[@]}" \
-      --prefix PATH ":" ${lib.makeBinPath [slurp hyprland]}
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          slurp
+          hyprland
+        ]
+      }
 
     wrapProgramShell $out/libexec/xdg-desktop-portal-hyprland \
-      --prefix PATH ":" ${lib.makeBinPath [(placeholder "out") hyprpicker]}
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          (placeholder "out")
+          hyprpicker
+        ]
+      }
   '';
 
-  meta = with lib; {
-    homepage = "https://github.com/hyprwm/xdg-desktop-portal-hyprland";
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "xdg-desktop-portal backend for Hyprland";
+    homepage = "https://github.com/hyprwm/xdg-desktop-portal-hyprland";
+    changelog = "https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v${finalAttrs.version}";
     mainProgram = "hyprland-share-picker";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fufexan ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fufexan ];
+    platforms = lib.platforms.linux;
   };
 })

pkgs/build-support/go/package.nix

@@ -289,4 +289,6 @@ lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "`buildFlags`/`buildFlagsArray` are deprecated and will be removed in the 24.11 release. Use the `ldflags` and/or `tags` attributes instead"
 lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
 lib.warnIf (builtins.elem "-trimpath" GOFLAGS) "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
+lib.warn '''buildGoPackage' is deprecated and will be removed for the 25.05 release.
+Please use 'buildGoModule' instead. Tips for migration can be found in the Go section of the nixpkgs manual.''
   package

pkgs/by-name/al/alp/package.nix

@@ -7,15 +7,15 @@
 
 buildGoModule rec {
   pname = "alp";
-  version = "1.1.17";
+  version = "1.1.18";
 
   src = fetchFromGitHub {
     owner = "gernotfeichter";
     repo = "alp";
     rev = version;
-    hash = "sha256-7lyWu1bVn7UwLb/Em6VBbg3FrMyxGjebxt5gJhm/xpI=";
+    hash = "sha256-tE8qKNXLKvFcnDULVkJJ/EJyEsvATCk/3YFkZCmpHSo=";
   };
-  vendorHash = "sha256-a2CQZKN/rPWh/Pn9gXfSArTCcGST472tsz1Kqm7M4vM=";
+  vendorHash = "sha256-AHPVhtm6La7HWuxJfpxTsS5wFTUZUJoVyebLGYhNKTg=";
 
   sourceRoot = "${src.name}/linux";
 

pkgs/by-name/ap/apx-gui/package.nix

@@ -12,17 +12,18 @@
 , wrapGAppsHook4
 , apx
 , gnome-console
+, vte-gtk4
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apx-gui";
-  version = "0.1.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner  = "Vanilla-OS";
     repo   = "apx-gui";
     rev    = "v${finalAttrs.version}";
-    hash = "sha256-orP5kAsoXX0zyDskeIPKKHNt5c757eUm9un4Ws6uFYA=";
+    hash = "sha256-Web2ErqJ2Wx/wK1lNvy6dD9JK7RIYSOycrXWgoVT1po=";
   };
 
   strictDeps = true;
@@ -34,12 +35,13 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    (python3.withPackages (ps: [ ps.pygobject3 ]))
+    (python3.withPackages (ps: [ ps.pygobject3 ps.requests ]))
     wrapGAppsHook4
   ];
 
   buildInputs = [
     libadwaita
+    vte-gtk4
   ];
 
   preFixup = ''

pkgs/by-name/aq/aquamarine/package.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+  hwdata,
+  hyprutils,
+  hyprwayland-scanner,
+  libdisplay-info,
+  libdrm,
+  libffi,
+  libGL,
+  libinput,
+  mesa,
+  nix-update-script,
+  pixman,
+  pkg-config,
+  seatd,
+  udev,
+  wayland,
+  wayland-protocols,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "aquamarine";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "hyprwm";
+    repo = "aquamarine";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-rux5XA+ixI0fuiQGSOerLKxsW2D8cfjmP1B7FY24xF8=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    hyprwayland-scanner
+    pkg-config
+  ];
+
+  buildInputs = [
+    hyprutils
+    libdisplay-info
+    libdrm
+    libffi
+    libGL
+    libinput
+    mesa
+    pixman
+    seatd
+    udev
+    wayland
+    wayland-protocols
+  ];
+
+  depsBuildBuild = [ hwdata ];
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  cmakeBuildType = "RelWithDebInfo";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    changelog = "https://github.com/hyprwm/aquamarine/releases/tag/${finalAttrs.version}";
+    description = "A very light linux rendering backend library";
+    homepage = "https://github.com/hyprwm/aquamarine";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      fufexan
+      johnrtitor
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/ar/archipelago/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+  nix-update-script,
+  extraPackages ? [ ],
+}:
+let
+  pname = "archipelago";
+  version = "0.5.0";
+  src = fetchurl {
+    url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
+    hash = "sha256-Dw5BBfCthB9xUJXYmnmIwmqlT/L24QZnKyELLjPGNRA=";
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+  extraPkgs =
+    pkgs:
+    [
+      pkgs.xsel
+      pkgs.xclip
+      pkgs.mtdev
+    ]
+    ++ extraPackages;
+  extraInstallCommands = ''
+    install -Dm444 ${appimageContents}/archipelago.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/archipelago.desktop \
+      --replace-fail 'opt/Archipelago/ArchipelagoLauncher' "archipelago"
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Multi-Game Randomizer and Server";
+    homepage = "https://archipelago.gg";
+    changelog = "https://github.com/ArchipelagoMW/Archipelago/releases/tag/${version}";
+    license = lib.licenses.mit;
+    mainProgram = "archipelago";
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/ar/arrow-glib/package.nix

@@ -1,21 +1,26 @@
-{ stdenv
-, arrow-cpp
-, glib
-, gobject-introspection
-, lib
-, meson
-, ninja
-, pkg-config
+{
+  arrow-cpp,
+  glib,
+  gobject-introspection,
+  lib,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  stdenv,
 }:
 
 stdenv.mkDerivation rec {
   pname = "arrow-glib";
   inherit (arrow-cpp) src version;
-  sourceRoot = "apache-arrow-${version}/c_glib";
+  sourceRoot = "source/c_glib";
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     meson
     ninja
+    python3
     pkg-config
     gobject-introspection
   ];
@@ -25,10 +30,10 @@ stdenv.mkDerivation rec {
     glib
   ];
 
-  meta = with lib; {
+  meta = {
     inherit (arrow-cpp.meta) license platforms;
     description = "GLib bindings for Apache Arrow";
     homepage = "https://arrow.apache.org/docs/c_glib/";
-    maintainers = with maintainers; [ amarshall ];
+    maintainers = with lib.maintainers; [ amarshall ];
   };
 }

pkgs/by-name/au/autoprefixer/tests/simple-execution.nix

@@ -1,10 +1,10 @@
 { runCommand, autoprefixer }:
 
 let
-  inherit (autoprefixer) packageName version;
+  inherit (autoprefixer) pname version;
 in
 
-runCommand "${packageName}-tests" { meta.timeout = 60; }
+runCommand "${pname}-tests" { meta.timeout = 60; }
   ''
     # get version of installed program and compare with package version
     claimed_version="$(${autoprefixer}/bin/autoprefixer --version | awk '{print $2}')"

pkgs/by-name/b3/b3sum/package.nix

@@ -1,22 +1,32 @@
-{ lib, fetchCrate, rustPlatform }:
+{
+  lib,
+  fetchCrate,
+  rustPlatform,
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "b3sum";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-PH7dP7Ytdgy28d2KLp8H3FCt7eFM4dchyEYqN1Yv7JI=";
+    hash = "sha256-wyr5LuFn3yRPJCyNfLT1Vgn6Sz1U4VNo0nppJrqE7IY=";
   };
 
-  cargoHash = "sha256-ex029iu7VZ3VtcGIqqX4ztn2ZXo0+yDv1JM9sz8vcJs=";
+  cargoHash = "sha256-v2sQKZ0DG08MDLho8fQ8O7fiNu+kxZB1sPNMgF5W2HA=";
 
   meta = {
     description = "BLAKE3 cryptographic hash function";
     mainProgram = "b3sum";
     homepage = "https://github.com/BLAKE3-team/BLAKE3/";
-    maintainers = with lib.maintainers; [ fpletz ivan ];
-    license = with lib.licenses; [ cc0 asl20 ];
+    maintainers = with lib.maintainers; [
+      fpletz
+      ivan
+    ];
+    license = with lib.licenses; [
+      cc0
+      asl20
+    ];
     changelog = "https://github.com/BLAKE3-team/BLAKE3/releases/tag/${version}";
   };
 }

pkgs/by-name/ba/bant/package.nix

@@ -5,7 +5,6 @@
   fetchFromGitHub,
   bazel_6,
   jdk,
-  git,
 }:
 
 let
@@ -18,13 +17,13 @@ let
   };
 in buildBazelPackage rec {
   pname = "bant";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-3xGAznR/IHQHY1ISqmU8NxI90Pl57cdYeRDeLVh9L08=";
+    hash = "sha256-4h76ok2aN7WfD8OHIS0O2Dk924+hFXJXewKRM7XYjKw=";
   };
 
   bazelFlags = ["--registry" "file://${registry}"];
@@ -35,14 +34,13 @@ in buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      aarch64-linux = "sha256-jtItWNfl+ebQqU8VWmvLsgNYNARGxN8+CTBz2nZcBEY=";
-      x86_64-linux = "sha256-ACJqybpHoMSg2ApGWkIyhdAQjIhb8gxUdo8SuWJvTNE=";
+      aarch64-linux = "sha256-38O9HPKMjqpNCO+kC8hUlsJAclONVCj3oj/iVRwOEDo=";
+      x86_64-linux = "sha256-OUVjgVIBNh0j10dgk/l42bqmsGuBC56uf4Ei/IRXxBI=";
     }.${system} or (throw "No hash for system: ${system}");
   };
 
   nativeBuildInputs = [
     jdk
-    git
   ];
   bazel = bazel_6;
 

pkgs/by-name/bu/bulky/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bulky";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "bulky";
     rev = version;
-    hash = "sha256-S4wAcwlJnXHYQEnP9WApCTjvVHKMrAt7gQ2l8zvFrs0=";
+    hash = "sha256-YByzRDL/LuI/VwBHLRZ3+S2VnttYeuMgJpRLPhR/NCA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cd/cdecl/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdecl";
-  version = "18.0";
+  version = "18.1";
 
   src = fetchFromGitHub {
     owner = "paul-j-lucas";
     repo = "cdecl";
     rev = "refs/tags/cdecl-${finalAttrs.version}";
-    hash = "sha256-w/x1cAldQh/aVZ9pjt5Vg8jDwCVtqTiKanXcDA6cpPU=";
+    hash = "sha256-qbb+xBGKNxteGMDcTy+o24EagupiSi/Zf/NLk7jpS0U=";
   };
 
   strictDeps = true;